h1 := &http.Transport{
		ExpectContinueTimeout: 3 * time.Second,
	}
	h2, _ := http2.ConfigureTransports(h1)
	h2.ReadIdleTimeout = 10 * time.Minute // TODO: much larger to support long-lived connections
	h2.AllowHTTP = true
	h2Server := &http2.Server{}
	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.Method == http.MethodConnect {
			if handleConnect(w, r) {
				return

        listener.onFailure(
          this,
          IllegalStateException("Invalid content-type: ${body.contentType()}"),
          response,
        )
        return
      }

      // This is a long-lived response. Cancel full-call timeouts.
      call?.timeout()?.cancel()

      // Replace the body with a stripped one so the callbacks can't see real data.
      val response = response.stripBody()

	"istio.io/istio/istioctl/pkg/clioptions"
	"istio.io/istio/pilot/pkg/model"
	"istio.io/istio/pkg/adsc"
	"istio.io/istio/pkg/kube"
)

const (
	// defaultExpirationSeconds is how long-lived a token to request (an hour)
	defaultExpirationSeconds = 60 * 60
)

// Audience to create tokens for
var tokenAudiences = []string{"istio-ca"}

 *
 * Further modification tracking is implemented with a subscription-based mechanism via [KotlinModificationTopics]. Modification trackers make the most
 * sense when there are many, possibly short-lived objects that need to be notified of a change. In such cases, subscriber management in the
 * message bus adds too much overhead.
 */
public abstract class KotlinModificationTrackerFactory : KotlinPlatformComponent {
    /**

            // This is a real problem on windows due to eager file locking and continuous CI failures.
            // On linux it's a lesser problem - long-lived daemons hung and steal resources but don't lock files.
            // So, for windows we'll only run tests against target gradle that supports ttl
            return false
        }

	if err != nil {
		return nil, err
	}
	return &tokenSupplier{
		Token:   tokenRequest.Status.Token,
		Expires: tokenRequest.Status.ExpirationTimestamp.Time,

		// Save in case we need to renew during a very long-lived gRPC
		tokenNamespace:      tokenNamespace,
		tokenServiceAccount: tokenSA,
		audiences:           tokenAudiences,
		expirationSeconds:   expirationSeconds,

	LabelTopologyRegion = "topology.kubernetes.io/region"

	// These label have been deprecated since 1.17, but will be supported for
	// the foreseeable future, to accommodate things like long-lived PVs that
	// use them.  New users should prefer the "topology.kubernetes.io/*"
	// equivalents.
	LabelFailureDomainBetaZone   = "failure-domain.beta.kubernetes.io/zone"   // deprecated

	})
	t.Run("VMs provisioned certificates - long lived", func(t *testing.T) {
		// User has certificates pre-provisioned on the VM by some sort of tooling, pointed to by
		// PROV_CERT. These are used for mTLS auth with XDS and CA. Certificates are long lived, we
		// always use the same certificate for control plane authentication and the short lived
		// certificates returned from the CA for workload authentication

        if (!longLivingProcess && !cacheInMemoryForShortLivedProcesses) {
            // Short-lived process, don't cache in memory
            LOG.debug("Creating cache {} without in-memory store.", cacheId);
            return backingCache;
        }
        int targetSize = cacheSizer.scaleCacheSize(maxEntriesToKeepInMemory);

				honored.WithLabelValues(signer).Inc()
			}
		}, nil
	}
}

func isDurationHonored(want, got time.Duration) bool {
	delta := want - got
	if delta < 0 {
		delta = -delta
	}

	// short-lived cert backdating + 5% of want
	maxDelta := 5*time.Minute + (want / 20)

	return delta < maxDelta
}

func compressSignerName(name string) string {
	if strings.HasPrefix(name, "kubernetes.io/") {
		return name