containers:
      - name: kube-proxy
        image: {{pillar['kube_docker_registry']}}/kube-proxy-{{pillar['host_arch']}}:{{pillar['kube-proxy_docker_tag']}}
        resources:
          requests:
            cpu: {{ cpurequest }}
            memory: {{ memoryrequest }}
        command:
        - /bin/sh
        - -c
        - kube-proxy {{cluster_cidr}} --oom-score-adj=-998 {{params}} 1>>/var/log/kube-proxy.log 2>&1
        env:

"hostNetwork": true,
"containers":[
    {
    "name": "cloud-controller-manager",
    "image": "gcr.io/k8s-staging-cloud-provider-gcp/cloud-controller-manager:v30.0.0",
    "resources": {
      "requests": {
        "cpu": "{{cpurequest}}"
      }
    },
    "args": [
      "--log-file=/var/log/cloud-controller-manager.log",
      "--also-stdout=false",
      "--redirect-stderr=true",
      "/cloud-controller-manager",
      {{params}}

	timeout := time.Second * 15
	req, err := downstream.Recv()
	if err != nil {
		log.Errorf("failed to recv: %v", err)
		return err
	}
	if strings.HasPrefix(req.TypeUrl, TypeDebugPrefix) {
		if resp, err := p.xdsProxy.tapRequest(req, timeout); err == nil {
			err := downstream.Send(resp)
			if err != nil {
				log.Errorf("failed to send: %v", err)
				return err
			}
		} else {
			log.Errorf("failed to call tap request: %v", err)

	// Only Stateful streams has flow control.
	OpUnblockClMux

	// OpAckMux acknowledges a mux was created.
	OpAckMux

	// OpRequest is a single request + response.
	// MuxID is returned in response.
	OpRequest

	// OpResponse is a response to a single request.
	// FlagPayloadIsErr is used to signify that the payload is a string error converted to byte slice.

		}
		if kubeContainerStatus.Resources.CPULimit != nil {
			currentCPULimit = kubeContainerStatus.Resources.CPULimit.MilliValue()
		}
		if kubeContainerStatus.Resources.CPURequest != nil {
			currentCPURequest = kubeContainerStatus.Resources.CPURequest.MilliValue()
		}
	}

	// Note: cgroup doesn't support memory request today, so we don't compare that. If canAdmitPod called  during

		Cert:          cert,
		ServerAddress: agent.proxyConfig.DiscoveryAddress,
		SAN:           p.istiodSAN,
	}, nil
}

// tapRequest() sends "req" to Istiod, and returns a matching response, or `nil` on timeout.
// Requests are serialized -- only one may be in-flight at a time.
func (p *XdsProxy) tapRequest(req *discovery.DiscoveryRequest, timeout time.Duration) (*discovery.DiscoveryResponse, error) {
	p.connectedMutex.Lock()

	return psp.podStatus, psp.found
}

func makePod(podUID, containerName, cpuRequest, cpuLimit string) *v1.Pod {
	pod := &v1.Pod{
		Spec: v1.PodSpec{
			Containers: []v1.Container{
				{
					Resources: v1.ResourceRequirements{
						Requests: v1.ResourceList{
							v1.ResourceName(v1.ResourceCPU):    resource.MustParse(cpuRequest),
							v1.ResourceName(v1.ResourceMemory): resource.MustParse("1G"),
						},

func (m *muxClient) roundtrip(h HandlerID, req []byte) ([]byte, error) {
	if m.init {
		return nil, errors.New("mux client already used")
	}
	m.init = true
	m.singleResp = true
	msg := message{
		Op:         OpRequest,
		MuxID:      m.MuxID,
		Handler:    h,
		Flags:      m.BaseFlags | FlagEOF,
		Payload:    req,
		DeadlineMS: uint32(m.deadline.Milliseconds()),
	}
	if m.subroute != nil {
		msg.Flags |= FlagSubroute
	}

					cpuRequest:    tc.apiSpecResources[idx].Requests.Cpu().MilliValue(),
				},
				currentContainerResources: &containerResources{
					memoryLimit:   tc.apiStatusResources[idx].Limits.Memory().Value(),
					memoryRequest: tc.apiStatusResources[idx].Requests.Memory().Value(),
					cpuLimit:      tc.apiStatusResources[idx].Limits.Cpu().MilliValue(),

	TimeStamp time.Time
}

// ContainerResources represents the Resources allocated to the running container.
type ContainerResources struct {
	// CPU capacity reserved for the container
	CPURequest *resource.Quantity
	// CPU limit enforced on the container
	CPULimit *resource.Quantity
	// Memory capaacity reserved for the container
	MemoryRequest *resource.Quantity
	// Memory limit enforced on the container