### CmdAdd Sidecar Workflow

`CmdAdd` is triggered when there is a new pod created. This runs on the node, in a chain of CNI plugins - Istio is
run after the main CNI sets up the pod IP and networking.

1. Check k8s pod namespace against exclusion list (plugin config)

  repeated CertificateSigningRequestCondition conditions = 1;

  // certificate is populated with an issued certificate by the signer after an Approved condition is present.
  // This field is set via the /status subresource. Once populated, this field is immutable.
  //
  // If the certificate signing request is denied, a condition of type "Denied" is added and this field remains empty.

  //   2. If ALL matchConditions evaluate to TRUE, the webhook is called.
  //   3. If any matchCondition evaluates to an error (but none are FALSE):
  //      - If failurePolicy=Fail, reject the request
  //      - If failurePolicy=Ignore, the error is ignored and the webhook is skipped
  //
  // This is an alpha feature and managed by the AdmissionWebhookMatchConditions feature gate.
  //
  // +patchMergeKey=name

     * </p>
     * <ul>
     *   <li>If {@link #MODULES} path type is also set, then the dependency can be placed either on the
     *       class-path or on the module-path, but only one of those. The choice is up to the plugin,
     *       possibly using heuristic rules (Maven 3 behavior).</li>
     *   <li>If a {@link #patchModule(String)} is also set and the main JAR file is placed on the module-path,

     *
     * Otherwise if the given path is a JAR file, then there is a choice:
     * <ul>
     *   <li>If a {@code module-info.class} file is found in the root directory or in a
     *       {@code "META-INF/versions/{n}/"} subdirectory, builds a singleton map with
     *       the module name declared in that descriptor.</li>
     *   <li>Otherwise if an {@code "Automatic-Module-Name"} attribute is declared in the

// Golang string equality. However, we assume the value returned by the LDAP
// server is canonical. Additionally, the attribute type names in the DN are
// lower-cased.
//
// Return values:
//
// If the DN is found, the normalized (string) value is returned and error is
// nil.
//
// If the DN is not found, the string returned is empty and the error is nil.
//

 *   <li>Any exception caught when attempting to close a resource that is <i>not</i> thrown (because
 *       another exception is already being thrown) is <i>suppressed</i>.
 * </ul>
 *
 * <p>An exception that is suppressed is not thrown. The method of suppression used depends on the
 * version of Java the code is running on:
 *
 * <ul>

   * threads take special action by participating in the signal-passing game.
   */

  /*
   * Timeout handling is intricate, especially given our ambitious goals:
   * - Avoid underflow and overflow of timeout values when specified timeouts are close to
   *   Long.MIN_VALUE or Long.MAX_VALUE.
   * - Favor responding to interrupts over timeouts.

  // Job is created in the suspended state, this field is not set until the
  // first time it is resumed. This field is reset every time a Job is resumed
  // from suspension. It is represented in RFC3339 form and is in UTC.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time startTime = 2;

  // Represents time when the job was completed. It is not guaranteed to

needs. The program is syntactically valid regardless of whether each
name is a type or an ordinary identifier, so there will be no syntax
errors that might stop parsing early.

An error on not-declared:1 indicates that foo is undeclared.
An error on not-type:1 indicates that foo is not a type (if declared at all, it is an identifier).
An error on not-int-const:1 indicates that foo is not an integer constant.