string v1beta1_field = 2;
}

message ExampleResponse {
	string error  = 1;
}

// Example is a simple example service for general reference on the recommended
// kubelet plugin model and plugin watcher testing.
service Example {
	rpc GetExampleInfo(ExampleRequest) returns (ExampleResponse) {}

	close(conn.initialized)
}

// ConnectionContext is used by the RPC event loop to respond to requests and pushes.
type ConnectionContext interface {
	XdsConnection() *Connection
	Watcher() Watcher
	// Initialize checks the first request.
	Initialize(node *core.Node) error
	// Close discards the connection.
	Close()
	// Process responds to a discovery request.

	string v1beta2_field = 2;
}

message ExampleResponse {
	string error  = 1;
}

// Example is a simple example service for general reference on the recommended
// kubelet plugin model and plugin watcher testing.
service Example {
	rpc GetExampleInfo(ExampleRequest) returns (ExampleResponse) {}

	reason string
}

func (e ConfigError) Error() string {
	return e.err.Error()
}

func (e ConfigError) Reason() string {
	return e.reason
}

func LoadCABundle(caBundleWatcher *keycertbundle.Watcher) ([]byte, error) {
	caBundle := caBundleWatcher.GetCABundle()
	if err := VerifyCABundle(caBundle); err != nil {
		return nil, &ConfigError{err, "could not verify caBundle"}
	}

	return caBundle, nil
}

}

func newLeaderElection(namespace, name, electionID, revision string, perRevision bool, remote bool, client kube.Client) *LeaderElection {
	var watcher revisions.DefaultWatcher
	if features.EnableLeaderElection {
		watcher = revisions.NewDefaultWatcher(client, revision)
	}
	if name == "" {
		hn, _ := os.Hostname()
		name = fmt.Sprintf("unknown-%s", hn)
	}
	if perRevision && revision != "" {

}

func (c *Context) Watcher() xds.Watcher {
	return c.w
}

func (w *Watch) DeleteWatchedResource(string) {
	w.Lock()
	defer w.Unlock()
	w.watch = nil
}

func (w *Watch) GetWatchedResource(string) *xds.WatchedResource {
	w.Lock()
	defer w.Unlock()
	return w.watch
}

func (w *Watch) NewWatchedResource(typeURL string, names []string) {
	w.Lock()

	return append(certPEM, caCert...), caCert, nil
}

// Return signed CSR through a watcher. If no CSR is read, return nil.
func readSignedCsr(client clientset.Interface, csr string, watchTimeout time.Duration) ([]byte, error) {
	selector := fields.OneTermEqualSelector("metadata.name", csr).String()
	// Setup a List+Watch, like informers do
	// A simple Watch will fail if the cert is signed too quickly

	caBundleWatcher *keycertbundle.Watcher

	queue controllers.Queue

	namespaces kclient.Client[*v1.Namespace]
	configmaps kclient.Client[*v1.ConfigMap]

	ignoredNamespaces sets.Set[string]
}

// NewNamespaceController returns a pointer to a newly constructed NamespaceController instance.
func NewNamespaceController(kubeClient kube.Client, caBundleWatcher *keycertbundle.Watcher) *NamespaceController {

			watcher, err := t.storage.(rest.Watcher).Watch(ctx, options)
			if err != nil {
				t.Errorf("unexpected error: %v, %v", err, action)
			}

			if err := emitFn(obj, action); err != nil {
				t.Errorf("unexpected error: %v", err)
			}

			select {
			case _, ok := <-watcher.ResultChan():
				if !ok {
					t.Errorf("watch channel should be open")
				}

// shouldn't we be doing this for both validating and mutating webhooks...?
func (c *Controller) startCaBundleWatcher(stop <-chan struct{}) {
	if c.o.CABundleWatcher == nil {
		return
	}
	id, watchCh := c.o.CABundleWatcher.AddWatcher()
	defer c.o.CABundleWatcher.RemoveWatcher(id)

	for {
		select {
		case <-watchCh:
			c.syncAll()
		case <-stop: