}

	p.addToCacheUnderLock(uid, workload)
	return workload.Netns
}

// Update the cache with the given uid and nspath. Return the Netns for the given uid.
// If uid is already present, a cached Netns is returned, and the given nspath is ignored.
func (p *podNetnsCache) Get(uid string) Netns {
	// lock current snapshot pod map
	p.mu.RLock()
	defer p.mu.RUnlock()
	if info, f := p.currentPodCache[uid]; f {

  repeated RuntimeClass items = 2;
}

// Scheduling specifies the scheduling constraints for nodes supporting a
// RuntimeClass.
message Scheduling {
  // nodeSelector lists labels that must be present on nodes that support this
  // RuntimeClass. Pods using this RuntimeClass can only be scheduled to a
  // node matched by this selector. The RuntimeClass nodeSelector is merged

  // +optional
  optional Scheduling scheduling = 3;
}

// Scheduling specifies the scheduling constraints for nodes supporting a
// RuntimeClass.
message Scheduling {
  // nodeSelector lists labels that must be present on nodes that support this
  // RuntimeClass. Pods using this RuntimeClass can only be scheduled to a
  // node matched by this selector. The RuntimeClass nodeSelector is merged

                                    description: REQUIRED if mode is `MUTUAL`.
                                    type: string
                                  sni:
                                    description: SNI string to present to the server
                                      during TLS handshake.
                                    type: string
                                  subjectAltNames:

### Install Istio CRDs

This is the first step of the installation. Please do not remove or edit any CRD - config currently requires
all CRDs to be present. On each upgrade it is recommended to reapply the file, to make sure
you get all CRDs.  CRDs are separated by release and by component type in the CRD directory.

                                    description: REQUIRED if mode is `MUTUAL`.
                                    type: string
                                  sni:
                                    description: SNI string to present to the server
                                      during TLS handshake.
                                    type: string
                                  subjectAltNames:

	if _, ok := annotationRegistry[name]; !ok {
		return false, "", fmt.Errorf("no registered annotation with name=%s", name)
	}
	// use annotation value if present
	if val, found := annotations[annotationRegistry[name].key]; found {
		if err := annotationRegistry[name].validator(val); err != nil {
			return true, annotationRegistry[name].defaultVal, err
		}
		return true, val, nil

	return cmd
}

func printCheckInjectorResults(writer io.Writer, was []webhookAnalysis) error {
	if len(was) == 0 {
		fmt.Fprintf(writer, "ERROR: no Istio injection hooks present.\n")
		return nil
	}
	w := table.NewStyleWriter(writer)
	w.SetAddRowFunc(func(obj interface{}) table.Row {
		wa := obj.(webhookAnalysis)
		row := table.Row{
			Cells: make([]table.Cell, 0),
		}

  // It is entirely possible to get an error and be able to continue determine authorization status in spite of it.
  // For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.
  // +optional
  optional string evaluationError = 3;
}

// SubjectRulesReviewStatus contains the result of a rules check. This check can be incomplete depending on

  local start
  start="$(date -u +%s.%N)"
  # First, get a trace and span ID. We need to get one now so we can propagate it to the child
  # Get trace ID from TRACEPARENT, if present
  local tid
  tid="$(<<<"${TRACEPARENT:-}" cut -d- -f2)"
  tid="${tid:-"$(tr -dc 'a-f0-9' < /dev/urandom | head -c 32)"}"
  # Always generate a new span ID
  local sid