return errors.New("not implemented on this platform")
}

func (m *realDeps) flush(name string) error {
	return errors.New("not implemented on this platform")
}

func (m *realDeps) clearEntriesWithComment(name, comment string) error {
	return errors.New("not implemented on this platform")
}

func (m *realDeps) clearEntriesWithIP(name string, ip netip.Addr) error {
	return errors.New("not implemented on this platform")
}

	defer span.End()
	if len(c) == 0 {
		log.Infof("nothing to make")
		return nil
	}
	if SkipMake == "true" {
		return nil
	}
	shortArgs := []string{}
	// Shorten output to avoid a ton of long redundant paths
	for _, cs := range c {
		shortArgs = append(shortArgs, filepath.Base(cs))
	}
	if len(c) == 0 {
		log.Infof("Nothing to make")
		return nil
	}

package app

// RaiseFileLimits sets the file limit to the maximum allowed, to avoid exhaustion of file descriptors.
// This is done by setting soft limit == hard limit.
// Typical container runtimes already do this, but on VMs, etc this is generally not the case, and a limit of 1024 is common -- this is quite low!
//
// Go already sets this (https://github.com/golang/go/issues/46279).
// However, it will restore the original limit for subprocesses (Envoy):

		// When Pilot exits, the lease will be dropped. This is more likely to lead to a case where
		// to instances are both considered the leaders. As such, if this is intended to be use for mission-critical
		// usages (rather than avoiding duplication of work), this may need to be re-evaluated.
		ReleaseOnCancel: true,
	}
	if !l.perRevision {
		// Function to use to decide whether this leader should steal the existing lock.

	// InstanceHostname defines the hostname of the service this filter chain is built for.
	// Note: This is best effort; this may be empty if generated by Sidecar config, and there may be multiple
	// Services that make up the filter chain.
	InstanceHostname host.Name
	// KubernetesServiceNamespace is the namespace the service is defined in, if it is for a Kubernetes Service.

// it might be.
//
// Instead, we rely directly on the procfs.
// This rules out two possible methods:
// * use crictl to inspect the pod; this returns the bind-mounted network namespace file.
// * /var/lib/cni/results shows the outputs of CNI plugins; this containers the bind-mounted network namespace file.
//
// Instead, we traverse the procfs. Comments on this method are inline.
func getPodNetNs(pod *corev1.Pod) (string, error) {

			// or it could be that the client has no sidecar, and it is directly making a HTTPS connection to
			// this sidecar. In this case, this filter chain is receiving plaintext one-way TLS traffic. The TLS
			// inspector would detect this as TLS traffic [not necessarily mTLS]. But since there is no ALPN to match,
			// this filter chain match will treat the traffic as just another TCP proxy.
			TransportProtocol: xdsfilters.TLSTransportProtocol,

	// TODO we should derive this from IngressClass
	IstioIngressLabelValue = "ingressgateway"

	// IstioSystemNamespace is the namespace where Istio's components are deployed
	IstioSystemNamespace = "istio-system"

	// DefaultAuthenticationPolicyName is the name of the cluster-scoped authentication policy. Only
	// policy with this name in the cluster-scoped will be considered.

		"Total number of XDS requests with an expired nonce.",
	)

	// pilot_total_xds_rejects should be used instead. This is for backwards compatibility
	cdsReject = monitoring.NewGauge(
		"pilot_xds_cds_reject",
		"Pilot rejected CDS configs.",
	)

	// pilot_total_xds_rejects should be used instead. This is for backwards compatibility
	edsReject = monitoring.NewGauge(
		"pilot_xds_eds_reject",
		"Pilot rejected EDS.",
	)

		// In theory, this should never happen, unless we decide a number was a bad idea in the future.
		return cur, false, false
	}
	if curNum > ControllerVersion {
		// A newer version owns this gateway, let them handle it
		return cur, false, false
	}
	if curNum == ControllerVersion {
		// We already manage this at this version