// when a WorkloadGroup is deleted, we can force disconnects
// when OnDisconnect occurs, we only trigger cleanup when there are no more connections for that proxy
type adsConnections struct {
	sync.Mutex

	// keyed by proxy id, then connection id
	byProxy map[proxyKey]map[string]connection
}

func newAdsConnections() *adsConnections {
	return &adsConnections{byProxy: map[proxyKey]map[string]connection{}}
}

    SortedSet<String> getNames();

    @Override
    @Internal
    List<Rule> getRules();

    @Override
    @Internal
    boolean isEmpty();

    /**
     * Returns the enabled reports, keyed by report name.
     *
     * @since 4.7
     */
    @Nested
    Map<String, T> getEnabledReports();

func NewNamespaceIndex[I Namespacer](c Collection[I]) *Index[I, string] {
	return NewIndex(c, func(o I) []string {
		return []string{o.GetNamespace()}
	})
}

// NewIndex creates a simple index, keyed by key K, over an informer for O. This is similar to
// NewInformer.AddIndex, but is easier to use and can be added after an informer has already started.
func NewIndex[I any, K comparable](
	c Collection[I],

	GRPCRoute      []config.Config
	TCPRoute       []config.Config
	TLSRoute       []config.Config
	ReferenceGrant []config.Config
	ServiceEntry   []config.Config
	// Namespaces stores all namespace in the cluster, keyed by name
	Namespaces map[string]*corev1.Namespace
	// Credentials stores all credentials in the cluster
	Credentials credentials.Controller

	// Domain for the cluster. Typically, cluster.local
	Domain  string

	Close() error
	Events(path string) chan fsnotify.Event
	Errors(path string) chan error
}

type fileWatcher struct {
	mu sync.RWMutex

	// The watcher maintain a map of workers,
	// keyed by watched dir (parent dir of watched files).
	workers map[string]*workerState

	funcs *patchTable
}

type workerState struct {
	worker *worker
	count  int
}

import (
	"sync"

	"istio.io/istio/pkg/cluster"
	"istio.io/istio/pkg/log"
	"istio.io/istio/pkg/util/sets"
)

// ClusterStore is a collection of clusters
type ClusterStore struct {
	sync.RWMutex
	// keyed by secret key(ns/name)->clusterID
	remoteClusters map[string]map[cluster.ID]*Cluster
	clusters       sets.String
}

// newClustersStore initializes data struct to store clusters information

	"github.com/golang/groupcache/lru"
	"k8s.io/apimachinery/pkg/types"
	kubecontainer "k8s.io/kubernetes/pkg/kubelet/container"
)

// ReasonCache stores the failure reason of the latest container start
// in a string, keyed by <pod_UID>_<container_name>. The goal is to
// propagate this reason to the container status. This endeavor is
// "best-effort" for two reasons:
//  1. The cache is not persisted.

// It is the recommended pattern used in all in-tree plugins - plugin-specific state is written once in PreFilter/PreScore and afterward read many times in Filter/Score.
type CycleState struct {
	// storage is keyed with StateKey, and valued with StateData.
	storage sync.Map
	// if recordPluginMetrics is true, metrics.PluginExecutionDuration will be recorded for this cycle.
	recordPluginMetrics bool

	if w != nil {
		w.Timer.Stop()
	}
}

// TimedWorkerQueue keeps a set of TimedWorkers that are still wait for execution.
type TimedWorkerQueue struct {
	sync.Mutex
	// map of workers keyed by string returned by 'KeyFromWorkArgs' from the given worker.
	workers  map[string]*TimedWorker
	workFunc func(ctx context.Context, fireAt time.Time, args *WorkArgs) error
	clock    clock.WithDelayedExecution
}

)

const (
	claimsVarName = "claims"
	userVarName   = "user"
)

// compiler implements the Compiler interface.
type compiler struct {
	// varEnvs is a map of CEL environments, keyed by the name of the CEL variable.
	// The CEL variable is available to the expression.
	// We have 2 environments, one for claims and one for user.
	varEnvs map[string]*environment.EnvSet
}