return err
	}
	defer func() {
		// Log sync will send logs to install-cni container via UDS.
		// We don't need a timeout here because underlying the log pkg already handles it.
		// this may fail, but it should be safe to ignore according
		// to https://github.com/uber-go/zap/issues/328
		_ = log.Sync()
	}()

	// TODO: implement plugin version
	funcs := skel.CNIFuncs{
		Add:   plugin.CmdAdd,
		Del:   plugin.CmdDelete,

				if err != nil {
					return err
				}
			}

			destLoggerLevels := map[string]Level{}
			if reset {
				// reset logging level to `defaultOutputLevel`, and ignore the `level` option
				levelString, _ := getLogLevelFromConfigMap(ctx)
				level, ok := stringToLevel[levelString]
				if ok {
					destLoggerLevels[defaultLoggerName] = level
				} else {

	iptablesBuilder.AppendVersionedRule("127.0.0.1/32", "::1/128",
		iptableslog.UndefinedCommand, ChainInpodPrerouting, iptablesconstants.MANGLE,
		"!", "-d", iptablesconstants.IPVersionSpecific, // ignore traffic to localhost ip, as this rule means to catch traffic to pod ip.
		"-p", iptablesconstants.TCP,
		"-i", "lo",
		"-j", "ACCEPT")

  // "csi.storage.k8s.io/ephemeral" is a new feature in Kubernetes 1.16. It is only
  // required for drivers which support both the "Persistent" and "Ephemeral" VolumeLifecycleMode.
  // Other drivers can leave pod info disabled and/or ignore this field.
  // As Kubernetes 1.15 doesn't support this field, drivers can only support one mode when
  // deployed on such a cluster and the deployment determines which mode that is, for example

// When using impersonation, users will receive the user info of the user being impersonated.  If impersonation or
// request header authentication is used, any extra keys will have their case ignored and returned as lowercase.
message SelfSubjectReview {
  // Standard object's metadata.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
  // +optional

		if ec := c.cfg.InitExitCode; ec == 0 || ec == int(state.ExitCode) {
			return true
		}
		return false
	}

	// Only check pods that have the sidecar annotation; the rest can be
	// ignored.
	if c.cfg.SidecarAnnotation != "" {
		if _, ok := pod.ObjectMeta.Annotations[c.cfg.SidecarAnnotation]; !ok {
			return false
		}
	}

	// For each candidate pod, iterate across all init containers searching for

		if existing.Netns.Inode() == workload.Netns.Inode() {
			workload.Netns.Close()
			// Replace the workload, but keep the old Netns
			p.currentPodCache[uid] = WorkloadInfo{
				Workload: workload.Workload,
				Netns:    existing.Netns,
			}
			// already in cache
			return existing.Netns
		}
		log.Debug("netns inode mismatch, using the new one")
	}

ame=$RELEASE kubectl --namespace $NAMESPACE --overwrite=true annotate $KIND $RELEASE meta.helm.sh/release-namespace=$NAMESPACE kubectl --namespace $NAMESPACE --overwrite=true label $KIND $RELEASE app.kubernetes.io/managed-by=Helm done ``` You may ignore errors about resources not being found. manifests/charts/gateway/values.yaml defaults: # Name allows overriding the release name. Generally this should not be set name: "" # revision declares which revision this gateway is a part of revision: "" #...

proxy3     cluster3     NOT SENT     ERROR       STALE       NOT SENT     NOT SENT     istiod3     1.20

# If you're looking at this file in a different repo and want to make a change, please go to the
# common-files repo, make the change there and check it in. Then come back to this repo and run
# "make update-common".

ignored:
  - DL3008
  - DL3059

trustedRegistries:
  - gcr.io
  - docker.io
  - quay.io
  - "*.pkg.dev"