SerialNumber string `json:"serial_number"`
	NotAfter     string `json:"not_after"`
	NotBefore    string `json:"not_before"`
	Type         string `json:"type"`
}

// NewSecretItemBuilder returns a new builder to create a secret item
func NewSecretItemBuilder() SecretItemBuilder {
	return &secretItemBuilder{}
}

// SecretItemBuilder wraps the process of setting fields for the SecretItem

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time lastUpdateTime = 4;

  // lastTransitionTime is the time the condition last transitioned from one status to another.
  // If unset, when a new condition type is added or an existing condition's status is changed,
  // the server defaults this to the current time.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time lastTransitionTime = 5;
}

Goals:
- Improve upgrade experience: users should be able to gradually roll upgrades, with proper
canary deployments for Istio components. It should be possible to deploy a new version while keeping the
stable version in place and gradually migrate apps to the new version.

- More flexibility: the new installer allows multiple 'environments', allowing applications to select

func AddInpodMarkIPRule(cfg *Config) error {
	return errors.New("not implemented on this platform")
}

func DelInpodMarkIPRule(cfg *Config) error {
	return errors.New("not implemented on this platform")
}

func AddLoopbackRoutes(cfg *Config) error {
	return errors.New("not implemented on this platform")
}

func DelLoopbackRoutes(cfg *Config) error {
	return errors.New("not implemented on this platform")

		// we get here in 2 cases:
		// 1. new pod was created on our node
		// 2. we were restarted and current existing pods are added to our cache

		// We have no good way to distinguish between these two cases from here. But we don't need to!
		// Existing pods will be handled by the dataplane using `GetAmbientPods`,
		// and the initial enqueueNamespace, and new pods will be handled by the CNI.

Release branches have a name of `release-MAJOR.MINOR`. Essential Istio repositories are branched from master roughly 4
weeks prior to a new release. The `istio/istio.io` repository does not get branched until the release is ready
for publication.

This document outlines getting in new features after a new branch has been cut and the process for getting a PR
merged in before and after the first public release.

# Feature Freeze

            print(datadiff.diff(s0, s1, fromfile=args.orig, tofile=args.new))

    return changed + len(added) + len(removed)


def main(args):
    return compare(args)


def get_parser():
    parser = argparse.ArgumentParser(
        description="Compare kubernetes yaml files")

    parser.add_argument("orig")
    parser.add_argument("new")

  document-start: disable
  empty-lines: disable
  empty-values: disable
  hyphens: enable
  indentation: disable
  key-duplicates: enable
  key-ordering: disable
  line-length: disable
  new-line-at-end-of-file: disable
  new-lines: enable
  octal-values: disable
  quoted-strings: disable
  trailing-spaces: disable

	"istio.io/istio/pkg/zdsapi"
)

var ztunnelTestCounter atomic.Uint32

func TestZtunnelSendsPodSnapshot(t *testing.T) {
	ztunnelKeepAliveCheckInterval = time.Second / 10
	mt := monitortest.New(t)
	setupLogging()
	ctx, cancel := context.WithCancel(context.Background())
	defer cancel()

	fixture := connect(ctx)
	ztunClient := fixture.ztunClient
	uid := fixture.uid

	m, fds := readRequest(t, ztunClient)

# The preview profile contains features that are experimental.
# This is intended to explore new features coming to Istio.
# Stability, security, and performance are not guaranteed - use at your own risk.
meshConfig:
  defaultConfig:
    proxyMetadata:
      # Enable Istio agent to handle DNS requests for known hosts
      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf