if c.NotAfter.After(fiveMinutesAgo) {
			validCerts = append(validCerts, c)
		}
	}

	return validCerts
}

// Enqueue a method to allow separate control loops to cause the controller to trigger and reconcile content.
func (c *Controller) Enqueue() {
	c.queue.Add(keyFn())
}

// Run the controller until stopped.
func (c *Controller) Run(ctx context.Context, workers int) {
	defer utilruntime.HandleCrash()

	asw.Lock()
	defer asw.Unlock()

	volumeObj, volumeExists := asw.attachedVolumes[volumeName]
	if !volumeExists {
		return
	}
	if volumeObj.deviceMountState != operationexecutor.DeviceMountUncertain {
		// Reconciler must have updated volume state, i.e. when a pod uses the volume and
		// succeeded mounting the volume. Such update has fixed the device path.
		return
	}

	volumeObj.devicePath = devicePath

		defer timeoutCancel()

		for _, object := range objects {
			if err := p.WaitForReconcile(timeoutCtx, object); err != nil {
				return fmt.Errorf("error waiting for reconcile of %v: %v", object, err)
			}
		}
	}
	return nil
}

// Depending upon object type, waits afterward until the object is synced
// by the policy source. Note that policies that are not bound are skipped,

			// we don't see the Update with DeletionTimestamp != 0.
			// TODO: instead of executing the operation directly in the handler, build a small cache with key node.Name
			// and value PodCIDRs use ReleaseCIDR on the reconcile loop so we can retry on `ReleaseCIDR` failures.
			if err := ra.ReleaseCIDR(logger, obj.(*v1.Node)); err != nil {
				utilruntime.HandleError(fmt.Errorf("error while processing CIDR Release: %w", err))
			}

kind: ConfigMap
metadata:
  labels:
    app: sidecar-injector
    istio: sidecar-injector
    operator.istio.io/component: Injector
    operator.istio.io/managed: Reconcile
    operator.istio.io/version: 1.3.1
    release: istio
  name: istio-sidecar-injector

	logger.V(4).Info("Pod deleted.", "pod", klog.KObj(pod), "caller", utilruntime.GetCaller())
	ssc.enqueueStatefulSet(set)
}

// getPodsForStatefulSet returns the Pods that a given StatefulSet should manage.
// It also reconciles ControllerRef by adopting/orphaning.
//
// NOTE: Returned Pods are pointers to objects from the cache.
// If you need to modify one, you need to copy it first.

kind: ConfigMap
metadata:
  labels:
    app: sidecar-injector
    istio: sidecar-injector
    operator.istio.io/component: Injector
    operator.istio.io/managed: Reconcile
    operator.istio.io/version: 1.3.1
    release: istio
  name: istio-sidecar-injector-canary

kind: ConfigMap
metadata:
  labels:
    app: sidecar-injector
    istio: sidecar-injector
    operator.istio.io/component: Injector
    operator.istio.io/managed: Reconcile
    operator.istio.io/version: 1.3.1
    release: istio
  name: istio-sidecar-injector

kind: ConfigMap
metadata:
  labels:
    app: sidecar-injector
    istio: sidecar-injector
    operator.istio.io/component: Injector
    operator.istio.io/managed: Reconcile
    operator.istio.io/version: 1.3.1
    release: istio
  name: istio-sidecar-injector

		podName, expectedVolumeName, "" /* SELinuxContext */); !podExistsInVolume {
		t.Fatalf(
			"DSW PodExistsInVolume returned incorrect value. Expected: <true> Actual: <%v>",
			podExistsInVolume)
	}

	// reconcile with actual state so that volume is added into the actual state
	// desired state populator now can successfully delete the pod and volume
	reconcileASW(fakeASW, dswp.desiredStateOfWorld, t)
	dswp.findAndRemoveDeletedPods()