// This is effectively an analog for Istio's old-style podSpec-based health check rewrites.
	// Before Istio would update the pod manifest to rewrite healthchecks to go to sidecar Envoy port 15021,
	// so that it could distinguish things that can be unauthenticated (healthchecks) from other kinds of node traffic

	var obj runtime.Object
	var ar *kube.AdmissionReview
	out, _, err := deserializer.Decode(body, nil, obj)
	if err != nil {
		return nil, fmt.Errorf("could not decode body: %v", err)
	}
	ar, err = kube.AdmissionReviewKubeToAdapter(out)
	if err != nil {
		return nil, fmt.Errorf("could not decode object: %v", err)
	}

	return ar.Response.Patch, nil
}

var (
	runtimeScheme = func() *runtime.Scheme {

		return shouldTrace(entry, traceOpts)
	}, &wg)
	if err != nil {
		return grid.NewRemoteErr(err)
	}

	// Publish bootstrap events that have already occurred before client could subscribe.
	if traceOpts.TraceTypes().Contains(madmin.TraceBootstrap) {
		go globalBootstrapTracer.Publish(ctx, globalTrace)
	}

	// Wait for remote to cancel and SubscribeJSON to exit.
	wg.Wait()
	return nil

	a, _, err := manifest.GenIOPFromProfile(profileA, "", setFlags, true, true, nil, l)
	if err != nil {
		return false, fmt.Errorf("could not read %q: %v", profileA, err)
	}

	b, _, err := manifest.GenIOPFromProfile(profileB, "", setFlags, true, true, nil, l)
	if err != nil {
		return false, fmt.Errorf("could not read %q: %v", profileB, err)
	}

	diff := util.YAMLDiff(a, b)
	if diff == "" {

		if !ok {
			return 0, errCastFailure("could not parse as int")
		}
		return res, nil
	case []byte:
		// Parse as number, truncate floating point if
		// needed.
		// String might contain trimming spaces, which
		// needs to be trimmed.
		res, ok := strToInt(strings.TrimSpace(string(x)))
		if !ok {
			return 0, errCastFailure("could not parse as int")
		}
		return res, nil

	default:

			portForwarder, err := client.NewPortForwarder(podName, ns, "", 0, controlzPort)
			if err != nil {
				return fmt.Errorf("could not build port forwarder for ControlZ %s: %v", podName, err)
			}
			defer portForwarder.Close()
			err = portForwarder.Start()
			if err != nil {
				return fmt.Errorf("could not start port forwarder for ControlZ %s: %v", podName, err)
			}

			ctrlzClient := &ControlzClient{
				baseURL: &url.URL{

	var err error
	for _, localPort := range portPrefs {
		var fw kube.PortForwarder
		fw, err = client.NewPortForwarder(podName, namespace, localAddress, localPort, remotePort)
		if err != nil {
			return fmt.Errorf("could not build port forwarder for %s: %v", flavor, err)
		}

		if err = fw.Start(); err != nil {
			fw.Close()
			// Try the next port
			continue
		}

	if err != nil {
		t.Fatalf("failed to generate service account YAML: %v", err)
	}
	objs, err := object.ParseK8sObjectsFromYAMLManifest(yaml)
	if err != nil {
		t.Fatalf("could not parse k8s objects from generated YAML: %v", err)
	}

	mustFindObject(t, objs, "istio-reader-service-account", "ServiceAccount")
	mustFindObject(t, objs, "istio-reader-clusterrole-istio-system", "ClusterRole")

	for dID, pi := range arg.Peers {
		if c.state.Peers != nil {
			if existingPeer, ok := c.state.Peers[dID]; ok {
				// retain existing ReplicateILMExpiry of peer if its already set
				// and incoming arg has it false. it could be default false
				if !pi.ReplicateILMExpiry && existingPeer.ReplicateILMExpiry {
					pi.ReplicateILMExpiry = existingPeer.ReplicateILMExpiry
				}
			}
		}
		peers[dID] = pi
	}
	state := srState{

func Map(mapping func(r rune) rune, s []byte) []byte {
	// In the worst case, the slice can grow when mapped, making
	// things unpleasant. But it's so rare we barge in assuming it's
	// fine. It could also shrink but that falls out naturally.
	b := make([]byte, 0, len(s))
	for i := 0; i < len(s); {
		wid := 1
		r := rune(s[i])
		if r >= utf8.RuneSelf {
			r, wid = utf8.DecodeRune(s[i:])
		}