// processes interleave.
	l.mu.Lock()
	defer l.mu.Unlock()
	for _, m := range messages {
		logger := pluginLog
		// For any k/v pairs, add them back
		for k, v := range m.Arbitrary {
			logger = logger.WithLabels(k, v)
		}
		// There is no fatal log from CNI plugin
		switch m.Level {
		case "debug":
			logger.LogWithTime(istiolog.DebugLevel, m.Msg, m.Time)
		case "info":

// Additionally, we need to jump through hoops to find the network namespace.
func (c *Controller) repairPod(pod *corev1.Pod) error {
	m := podsRepaired.With(typeLabel.Value(repairType))
	log := repairLog.WithLabels("pod", pod.Namespace+"/"+pod.Name)
	key := types.NamespacedName{Name: pod.Name, Namespace: pod.Namespace}
	// We will get an event every time the pod changes. The repair is not instantaneous, though -- it will only recover

	istiolog.FindScope("default").SetOutputLevel(istiolog.DebugLevel)
	istiolog.Debug("debug log")
	istiolog.Info("info log")
	istiolog.Warn("warn log")
	istiolog.Error("error log")
	istiolog.WithLabels("key", 2).Infof("with labels")
	// This will error because stdout cannot sync, but the UDS part should sync
	// Ideally we would fail if the UDS part fails but the error library makes it kind of tricky
	_ = istiolog.Sync()

	token := checkToken(ctx, at)
	cert := checkCert(ctx, ac)
	id := []string{spiffe.Identity{
		TrustDomain:    "cluster.local",
		Namespace:      "fake-namespace",
		ServiceAccount: "fake-sa",
	}.String()}
	log.WithLabels("name", f.Name, "cert", cert, "token", token).Infof("authentication complete")
	if cert == nil {
		f.Successes.Inc()
		return &Caller{
			AuthSource: AuthSourceClientCertificate,
			Identities: id,
		}, nil

	b.ensureObjectMetaApplyConfigurationExists()
	b.DeletionGracePeriodSeconds = &value
	return b
}

// WithLabels puts the entries into the Labels field in the declarative configuration
// and returns the receiver, so that objects can be build by chaining "With" function invocations.

	b.ensureObjectMetaApplyConfigurationExists()
	b.DeletionGracePeriodSeconds = &value
	return b
}

// WithLabels puts the entries into the Labels field in the declarative configuration
// and returns the receiver, so that objects can be build by chaining "With" function invocations.

			}
			cacheLog.WithLabels("ttl", time.Until(c.ExpireTime)).Info("returned workload trust anchor from cache")

		} else {
			ns = &security.SecretItem{
				ResourceName:     resourceName,
				CertificateChain: c.CertificateChain,
				PrivateKey:       c.PrivateKey,
				ExpireTime:       c.ExpireTime,
				CreatedTime:      c.CreatedTime,
			}

	o := buildCollectionOptions(opts...)
	if o.name == "" {
		o.name = fmt.Sprintf("NewInformer[%v]", ptr.TypeName[I]())
	}
	h := &informer[I]{
		inf:            c,
		log:            log.WithLabels("owner", o.name),
		collectionName: o.name,
		id:             nextUID(),
		eventHandlers:  &handlers[I]{},
		augmentation:   o.augmentation,
		synced:         make(chan struct{}),
	}

	go func() {

	id := uuid.New()
	remoteAddr, _, err := net.SplitHostPort(r.RemoteAddr)
	if err != nil {
		epLog.Warnf("failed to get host from remote address: %s", err)
	}
	epLog.WithLabels("remoteAddr", remoteAddr, "method", r.Method, "url", r.URL, "host", r.Host, "headers", r.Header, "id", id).Infof("%v Request", r.Proto)
	if h.Port == nil {

	if caller == nil || err != nil {
		s.monitoring.AuthnError.Increment()
		return nil, status.Error(codes.Unauthenticated, "request authenticate failure")
	}

	serverCaLog := serverCaLog.WithLabels("client", security.GetConnectionAddress(ctx))
	// By default, we will use the callers identity for the certificate
	sans := caller.Identities
	crMetadata := request.Metadata.GetFields()