})
	if err != nil {
		return fmt.Errorf("failed to add IP %s with and proto %d to ipset %s: %w", ip, ipProto, name, err)
	}
	return nil
}

func (m *realDeps) deleteIP(name string, ip netip.Addr, ipProto uint8) error {
	err := netlink.IpsetDel(name, &netlink.IPSetEntry{
		IP:       net.IP(ip.AsSlice()),
		Protocol: &ipProto,
	})
	if err != nil {

	f := filepath.Join(t.TempDir(), "test")
	l, err := NewListener(f)
	if err != nil {
		t.Fatalf("unexpected error %v", err)
	}
	defer l.Close()
	conn, err := connect(f)
	if err != nil {
		t.Fatalf("failed to connect %v", err)
	}
	conn.Close()
}

func connect(socket string) (*grpc.ClientConn, error) {
	var opts []grpc.DialOption

  // Specifies the policy of handling failed pods. In particular, it allows to
  // specify the set of actions and conditions which need to be
  // satisfied to take the associated action.
  // If empty, the default behaviour applies - the counter of failed pods,
  // represented by the jobs's .status.failed field, is incremented and it is
  // checked against the backoffLimit. This field cannot be used in combination

									log.Errorf("found RBAC HTTP filter but failed to parse: %s", err)
								} else {
									parsedFC.rbacHTTP = append(parsedFC.rbacHTTP, rbacHTTP)
								}
							}
						}
					}
				case wellknown.RoleBasedAccessControl:
					rbacTCP := &rbactcp.RBAC{}
					if err := getFilterConfig(filter, rbacTCP); err != nil {
						log.Errorf("found RBAC network filter but failed to parse: %s", err)
					} else {

}

message CertificateSigningRequestCondition {
  // type of the condition. Known conditions include "Approved", "Denied", and "Failed".
  optional string type = 1;

  // Status of the condition, one of True, False, Unknown.
  // Approved, Denied, and Failed conditions may not be "False" or "Unknown".
  // Defaults to "True".
  // If unset, should be treated as "True".
  // +optional
  optional string status = 6;

		}
		if r := cmp.Compare(a.Name, b.Name); r != 0 {
			return r
		}
		return cmp.Compare(a.Hostname, b.Hostname)
	})
	out, err := json.MarshalIndent(svcs, "", "    ")
	if err != nil {
		return fmt.Errorf("failed to marshal workloads: %v", err)
	}
	if outputFormat == "yaml" {
		if out, err = yaml.JSONToYAML(out); err != nil {
			return err
		}
	}
	fmt.Fprintln(c.Stdout, string(out))
	return nil

		return fmt.Errorf("failed to install manifests: %v", err)
	}
	opts := &helmreconciler.ProcessDefaultWebhookOptions{
		Namespace: ns,
		DryRun:    rootArgs.DryRun,
	}
	if processed, err := helmreconciler.ProcessDefaultWebhook(kubeClient, iop, exists, opts); err != nil {
		return fmt.Errorf("failed to process default webhook: %v", err)
	} else if processed {

	}

	if c.shouldFail {
		if fErr == nil {
			t.Fatalf("Command should have failed for 'istioctl %s', didn't get one, output was %q",
				c.args, output)
		}
	} else {
		if fErr != nil {
			t.Fatalf("Command should not have failed for 'istioctl %s': %v", c.args, fErr)
		}
	}

// newK8sClient returns a Kubernetes client
func newK8sClient(conf Config) (kubernetes.Interface, error) {
	// Some config can be passed in a kubeconfig file
	kubeconfig := conf.Kubernetes.Kubeconfig

	config, err := kube.DefaultRestConfig(kubeconfig, "")
	if err != nil {
		log.Errorf("Failed setting up kubernetes client with kubeconfig %s", kubeconfig)
		return nil, err
	}

  // +optional
  optional string timeZone = 8;

  // Optional deadline in seconds for starting the job if it misses scheduled
  // time for any reason.  Missed jobs executions will be counted as failed ones.
  // +optional
  optional int64 startingDeadlineSeconds = 2;

  // Specifies how to treat concurrent executions of a Job.
  // Valid values are:
  //