if (failed(DecomposeTensorListOpsInternal(
            &branch.front(), module, &branch_map,
            decomposed_partitioned_call_callees)))
      return failure();
  }

  const bool arg_no_changed = branch_maps.front().empty();
  auto output_buffer_to_size =
      ModifyFunctionReturn(branches.front(), branch_maps.front());
  for (const auto& pair : llvm::drop_begin(llvm::zip(branches, branch_maps), 1))

				"ca.key":                 caKey,
				"front-proxy-ca.crt":     fpCACert,
				"front-proxy-client.crt": fpCert,
				"front-proxy-client.key": fpKey,
				"etcd/ca.crt":            etcdCACert,
				"etcd/ca.key":            etcdCAKey,
			},
		},
		{
			Name: "FrontProxy certs missing CA",
			Files: PKIFiles{
				"front-proxy-client.crt": fpCert,
				"front-proxy-client.key": fpKey,
			},
			ExpectError: true,

  const bool signature_change = !then_map.empty() || !else_map.empty();
  if (failed(DecomposeStackOpsInternal(&then_func.front(), module, &then_map,
                                       decomposed_partitioned_call_callees)) ||
      failed(DecomposeStackOpsInternal(&else_func.front(), module, &else_map,
                                       decomposed_partitioned_call_callees))) {
    return failure();
  }

                                        num_cores_per_replica);
  for (mlir::Region& region : old_parallel_execute.getRegions()) {
    if (!llvm::isa<tf_device::ClusterFuncOp>(region.front().front())) {
      for (Type t : region.front().front().getResultTypes())
        concatenated_output_types.emplace_back(t);
    }
  }

  for (int core = 0; core < num_cores_per_replica; ++core) {

  if (auto control_node = dyn_cast<mlir::TFL::ControlNodeOp>(*op)) {
    return IsFlexDelegate(&control_node.getBody().front().front());
  }
  if (auto custom_tf_op = dyn_cast<mlir::TFL::CustomTfOp>(*op)) {
    return IsFlexDelegate(&custom_tf_op.getBody().front().front());
  }

  // Our MLIR might be the result of a conversion from a previously generated
  // flatbuffer file.

bool IsSupportedGraph(func::FuncOp func) {
  if (!llvm::hasSingleElement(func)) return false;

  Block& block = func.front();
  if (!llvm::hasSingleElement(block.without_terminator())) return false;

  auto graph = llvm::dyn_cast<tf_executor::GraphOp>(block.front());
  if (!graph) return false;

  Operation* terminator = block.getTerminator();

// KubeadmCertFrontProxyCA is the definition of the CA used for the front end proxy.
func KubeadmCertFrontProxyCA() *KubeadmCert {
	return &KubeadmCert{
		Name:     "front-proxy-ca",
		LongName: "self-signed CA to provision identities for front proxy",
		BaseName: kubeadmconstants.FrontProxyCACertAndKeyBaseName,
		config: pkiutil.CertConfig{
			Config: certutil.Config{
				CommonName: "front-proxy-ca",
			},
		},
	}
}

    if (call.getOperation()->getNumOperands() !=
        f.getBody().front().getNumArguments()) {
      return failure();  // RemoteCall et al
    }

    rewriter.startOpModification(f);
    bool changed = false;
    for (auto [call_arg, body_arg] :
         llvm::zip(call.getOperation()->getOperands(),
                   f.getBody().front().getArguments())) {
      if (call_arg.getType() != body_arg.getType()) {

}

// UsingExternalFrontProxyCA determines whether the user is relying on an external front-proxy CA.  We currently implicitly determine this is the case
// when the front proxy CA Cert is present but the front proxy CA Key is not.
// In case we are using an external front-proxy CA, the function validates the certificates signed by front-proxy CA that should be provided by the user.

  added_call_op->setAttr(kInterfaceNameAttr, interface_name);

  StringAttr device = mlir::cast<StringAttr>(
      added_func_op->getRegion(0).getBlocks().front().front().getAttr(kDevice));
  StringAttr inference_type = mlir::cast<StringAttr>(
      added_func_op->getRegion(0).getBlocks().front().front().getAttr(
          kInferenceType));
  added_call_op->setAttr(kDevice, device);
  added_call_op->setAttr(kInferenceType, inference_type);