The Health Check controller additionally controls the health status of the `WorkloadEntry`. The health is reported over the XDS client and synced with the `WorkloadEntry`.

#### Webhooks

                .filter(rap -> !allAvailableProfiles.contains(rap))
                .collect(toSet());

        if (!notFoundRequiredProfiles.isEmpty()) {
            // Use SLF4J formatter for consistency with warnings reported by logger
            final String message = MessageFormatter.format(
                            "The requested profiles {} could not be activated or deactivated because they do not"

func newRateMeasurement(initTime time.Time) *rateMeasurement {
	return &rateMeasurement{
		startTime: initTime,
	}
}

// incrementBytes add bytes reported for a bucket/target.
func (m *rateMeasurement) incrementBytes(bytes uint64) {
	atomic.AddUint64(&m.bytesSinceLastWindow, bytes)
}

// updateExponentialMovingAverage processes the measurements captured so far.

     * including in MapRetrievalCache, so I'm not sure why this one is different. I did at least
     * confirm that my change to MapIteratorCache fixes the TSAN error in the (larger) test it was
     * originally reported in.
     */
    for (Future<?> future : futures.build()) {
      future.get();
    }
    executor.shutdown();
  }

            "uid": "${datasource}"
          },
          "expr": "sum(irate(istio_response_bytes_sum{source_workload_namespace!=\"istio-system\", reporter=\"source\"}[1m])) + sum(irate(istio_request_bytes_sum{source_workload_namespace!=\"istio-system\", reporter=\"source\"}[1m]))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "istio-proxy",
          "refId": "B"
        }

- Fixed two scheduler metrics (pending_pods and schedule_attempts_total) not being recorded ([#87692](https://github.com/kubernetes/kubernetes/pull/87692), [@everpeace](https://github.com/everpeace)) [SIG Scheduling]
- Fixes an issue with kubelet-reported pod status on deleted/recreated pods. ([#86320](https://github.com/kubernetes/kubernetes/pull/86320), [@liggitt](https://github.com/liggitt)) [SIG Node]

      /** The executor on which this Callable will be scheduled. */
      private final ScheduledExecutorService executor;

      /**
       * The service that is managing this callable. This is used so that failure can be reported
       * properly.
       */
      /*
       * This reference is part of a reference cycle, which is typically something we want to avoid

  // +listType=atomic
  // +optional
  repeated NamedRuleWithOperations resourceRules = 3;

  // ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about.
  // The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
  // +listType=atomic
  // +optional
  repeated NamedRuleWithOperations excludeResourceRules = 4;

    ],
)

# Packages that use private types symbols, until they are exported.
# TODO(b/154650521) Remove.
# If this is modified, then copy.bara.sky must also be modified.
package_group(name = "types_allowlist")

# Packages that use StructuredTensors.
# TODO(b/159007891) Remove this package once StructuredTensor is exported.
# LINT.IfChange
package_group(name = "structured_tensor_allowlist")

  /**
   * If true, report on stdout all "slow" tests, that is, ones that take more than profileThreshold
   * milliseconds to execute.
   */
  private static final boolean profileTests = Boolean.getBoolean("jsr166.profileTests");

  /**
   * The number of milliseconds that tests are permitted for execution without being reported, when
   * profileTests is set.
   */