// in-cluster DNS as that would be a layering violation). `host` may
  // also be an IP address.
  //
  // Please note that using `localhost` or `127.0.0.1` as a `host` is
  // risky unless you take great care to run this webhook on all hosts
  // which run an apiserver which might need to make calls to this
  // webhook. Such installs are likely to be non-portable, i.e., not easy
  // to turn up in a new cluster.
  //

  // +optional
  optional int64 activeDeadlineSeconds = 3;

  // Specifies the policy of handling failed pods. In particular, it allows to
  // specify the set of actions and conditions which need to be
  // satisfied to take the associated action.
  // If empty, the default behaviour applies - the counter of failed pods,
  // represented by the jobs's .status.failed field, is incremented and it is

  // in-cluster DNS as that would be a layering violation). `host` may
  // also be an IP address.
  //
  // Please note that using `localhost` or `127.0.0.1` as a `host` is
  // risky unless you take great care to run this webhook on all hosts
  // which run an apiserver which might need to make calls to this
  // webhook. Such installs are likely to be non-portable, i.e., not easy
  // to turn up in a new cluster.
  //

	// within all pods as we do on the host.
	//
	// This should be fine, as the host binaries are all we have to work with here anyway,
	// as we are running within a privileged container - and we don't want to take the time to
	// redetect for each pod anyway.
	//
	// Extreme corner case:
	// If for some reason your host had both binaries, and you were injecting out-of-band

	PodDeleted(ctx context.Context, uid string) error
	PodAdded(ctx context.Context, pod *v1.Pod, netns Netns) error
	Close() error
}

/*
To clean up stale ztunnels

	we may need to ztunnel to send its (uid, bootid / boot time) to us
	so that we can remove stale entries when the ztunnel pod is deleted
	or when the ztunnel pod is restarted in the same pod (remove old entries when the same uid connects again, but with different boot id?)

      {{- end }}
      {{- else }}
      discoveryAddress: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{.Release.Namespace}}.svc:15012
      {{- end }}
{{- end }}

{{/* We take the mesh config above, defined with individual values.yaml, and merge with .Values.meshConfig */}}
{{/* The intent here is that meshConfig.foo becomes the API, rather than re-inventing the API in values.yaml */}}

      and apparatus claims, in any patent Licensable by such Contributor that
      would be infringed, but for the grant of the License, by the making,
      using, selling, offering for sale, having made, import, or transfer of
      either its Contributions or its Contributor Version.

1.12. “Secondary License”

      means either the GNU General Public License, Version 2.0, the GNU Lesser

	assert.Equal(t, nlDeps.DelInpodMarkIPRuleCnt.Load(), 1)
	assert.Equal(t, nlDeps.DelLoopbackRoutesCnt.Load(), 1)
	// make sure the uid was taken from cache and netns closed
	netns := fixture.podNsMap.Take(string(pod.UID))
	assert.Equal(t, nil, netns)

	// run gc to clean up ns:

	//revive:disable-next-line:call-to-gc Just a test that we are cleaning up the netns
	runtime.GC()
	assertNSClosed(t, closed)
}

  // will be reported as an event when the container is starting. When a key exists in multiple
  // sources, the value associated with the last source will take precedence.
  // Values defined by an Env with a duplicate key will take precedence.
  // Cannot be updated.
  // +optional
  repeated EnvFromSource envFrom = 19;

  // List of environment variables to set in the container.
  // Cannot be updated.

NAME       CLUSTER      CDS       LDS        EDS        RDS          ECDS         ISTIOD      VERSION
proxy1     cluster1     STALE     SYNCED     SYNCED     NOT SENT     NOT SENT     istiod1     1.1