}

        result.remote.config.useExpectContinue == "false"

        result.remote.type == 'HTTP'
        result.remote.push == push


        where:
        authenticated | credentials            | push
        'true'        | SOME_CREDENTIALS       | true
        'false'       | NO_CREDENTIALS         | false
        'false'       | INCOMPLETE_CREDENTIALS | false
    }

}

func buildMetricsNetworkFilters(push *model.PushContext, proxy *model.Proxy, class istionetworking.ListenerClass, svc *model.Service) []*listener.Filter {
	return push.Telemetry.TCPFilters(proxy, class, svc)
}

// setAccessLogAndBuildTCPFilter sets the AccessLog configuration in the given
// TcpProxy instance and builds a TCP filter out of it.
func setAccessLogAndBuildTCPFilter(push *model.PushContext, node *model.Proxy,

//
//	!h.Less(j, i) for 0 <= i < h.Len() and 2*i+1 <= j <= 2*i+2 and j < h.Len()
//
// Note that [Push] and [Pop] in this interface are for package heap's
// implementation to call. To add and remove things from the heap,
// use [heap.Push] and [heap.Pop].
type Interface interface {
	sort.Interface
	Push(x any) // add x as element Len()
	Pop() any   // remove and return element Len() - 1.
}

mkdir -p "${_kubetmp}"
tar --exclude=.git --exclude="./_*" -c . | (cd "${_kubetmp}" && tar xf -)

pushd "${_kubetmp}" > /dev/null 2>&1
  # Destroy deps in the copy of the kube tree
  rm -rf ./vendor ./LICENSES

  # Recreate the vendor tree using the nice clean set we just downloaded
  hack/update-vendor.sh
popd > /dev/null 2>&1

ret=0

pushd "${KUBE_ROOT}" > /dev/null 2>&1
  # Test for diffs

			// Waypoint proxies have a matcher against pod IPs in them. Historically, any LDS change would do a full
			// push, recomputing push context. Doing that on every IP change doesn't scale, so we need these to remain
			// incremental pushes.
			// This allows waypoints only to push LDS on incremental pushes to Address type which would otherwise be skipped.
			return true
		}

all-push-images: $(addprefix sub-push-image-,$(ALL_OS_ARCH))

# NOTE(claudiub): A non-default builder instance is needed in order to build Windows images.
all-push: all-push-images push-manifest

push-manifest:
	docker manifest create --amend $(MANIFEST_IMAGE):$(IMAGE_TAG) $(shell echo $(ALL_OS_ARCH) | sed -e "s~[^ ]*~$(MANIFEST_IMAGE):$(IMAGE_TAG)\-&~g")

		tcpGrpcListenerAccessLog: tcpGrpcAccessLog(true),
	}
}

func (b *AccessLogBuilder) setTCPAccessLog(push *model.PushContext, proxy *model.Proxy, tcp *tcp.TcpProxy, class networking.ListenerClass, svc *model.Service) {
	mesh := push.Mesh
	cfgs := push.Telemetry.AccessLogging(push, proxy, class, svc)

	if len(cfgs) == 0 {
		// No Telemetry API configured, fall back to legacy mesh config setting

type lfstack uint64

func (head *lfstack) push(node *lfnode) {
	node.pushcnt++
	new := lfstackPack(node, node.pushcnt)
	if node1 := lfstackUnpack(new); node1 != node {
		print("runtime: lfstack.push invalid packing: node=", node, " cnt=", hex(node.pushcnt), " packed=", hex(new), " -> node=", node1, "\n")
		throw("lfstack.push")
	}
	for {
		old := atomic.Load64((*uint64)(head))
		node.next = old

}

var _ model.XdsResourceGenerator = &EcdsGenerator{}

func ecdsNeedsPush(req *model.PushRequest) bool {
	if req == nil {
		return true
	}
	// If none set, we will always push
	if len(req.ConfigsUpdated) == 0 {
		return true
	}
	// Only push if config updates is triggered by EnvoyFilter, WasmPlugin, or Secret.
	for config := range req.ConfigsUpdated {
		switch config.Kind {
		case kind.EnvoyFilter:
			return true

				proxy:              sidecarNode,
				push:               push,
				routeConfiguration: sidecarOutboundRC,
			},
			want: patchedSidecarOutputRC,
		},
		{
			name: "sidecar inbound rc patch",
			args: args{
				patchContext:       networking.EnvoyFilter_SIDECAR_INBOUND,
				proxy:              sidecarNode,
				push:               push,
				routeConfiguration: sidecarInboundRC,
			},