// secret, and replace the env variable value with it. When ECDS config update reaches the proxy,
	// agent will extract out the secret from env variable, use it for image pulling, and strip the
	// env variable from VM config before forwarding it to envoy.
	envs := pluginConfig.GetVmConfig().GetEnvironmentVariables().GetKeyValues()
	secretName := envs[model.WasmSecretEnv]

		// Anything other than "file not found" is an error.
		return nil, fmt.Errorf("failed to remove unix://%s: %v", path, err)
	}

	// Attempt to create the folder in case it doesn't exist
	if err := os.MkdirAll(filepath.Dir(path), 0o750); err != nil {
		// If we cannot create it, just warn here - we will fail later if there is a real error
		log.Warnf("Failed to create directory for %v: %v", path, err)
	}

	var err error

  // +optional
  repeated ImageReviewContainerSpec containers = 1;

  // Annotations is a list of key-value pairs extracted from the Pod's annotations.
  // It only includes keys which match the pattern `*.image-policy.k8s.io/*`.
  // It is up to each webhook backend to determine how to interpret these annotations, if at all.
  // +optional
  map<string, string> annotations = 2;

    istioNamespace: istio-system

    externalIstiod: false
    remotePilotAddress: ""

    # Platform where Istio is deployed. Possible values are: "openshift", "gcp".
    # An empty value means it is a vanilla Kubernetes distribution, therefore no special
    # treatment will be considered.
    platform: ""

type SetupFn func(ctx Context) error

// TeardownFn is a function used for performing tear-down actions.
type TeardownFn func(ctx Context)

// ShouldSkipFn is a function used for performing skip actions; if it returns true a job is skipped
// Note: function may be called multiple times during the setup process.

      Note: most resources have a suffix automatically added in addition.
      In the old chart, this was `-{{ .Values.global.istioNamespace }}`.

				if err == nil && s != nil && s.IsDir() {
					// If it's a directory, add a watch for it so we see nested files.
					if e.Op&fsnotify.Create != 0 {
						log.Debugf("add watch for %v: %v", s.Name(), watcher.watchRecursive(e.Name))
					}
				}
				// Can't stat a deleted directory, so attempt to remove it. If it fails it is not a problem
				if e.Op&fsnotify.Remove != 0 {
					_ = watcher.Remove(e.Name)
				}

				"domain or its aliases", trustDomainFromPrincipal, principal)
			// when SkipValidateTrustDomain is being used the message isn't very meaningful so we'll log it at a lower level
			// logging it at this level may help users who are looking to disable skipping validation understand if it's safe
			if !features.SkipValidateTrustDomain {
				authzLog.Warn(msg)
			} else {
				authzLog.Debug(msg)
			}

	"go.uber.org/atomic"
)

// SetForTest sets a variable for the duration of a test, then resets it once the test is complete.
func SetForTest[T any](t Failer, vv *T, v T) {
	old := *vv
	*vv = v
	t.Cleanup(func() {
		*vv = old
	})
}

// SetEnvForTest sets an environment variable for the duration of a test, then resets it once the test is complete.
func SetEnvForTest(t Failer, k, v string) {
	old, oldset := os.LookupEnv(k)

  // without any of its container crashing, for it to be considered available.
  // Defaults to 0 (pod will be considered available as soon as it is ready)
  // +optional
  optional int32 minReadySeconds = 4;

  // Selector is a label query over pods that should match the replica count.
  // Label keys and values that must match in order to be controlled by this replica set.
  // It must match the pod template's labels.