// as it opens the risk of lock contention with other node actors (such as kube-proxy), and isn't actually needed at all.
		// Older iptables cannot turn off the lock explicitly, so we hack around it...
		// Overwrite the lock file with the network namespace file (which is assumed to be unique).
		// We are setting the lockfile to `r.NetworkNamespace`.

  // risky unless you take great care to run this webhook on all hosts
  // which run an apiserver which might need to make calls to this
  // webhook. Such installs are likely to be non-portable, i.e., not easy
  // to turn up in a new cluster.
  //
  // The scheme must be "https"; the URL must begin with "https://".
  //
  // A path is optional, and if present may be any string permissible in

	// this would return true only if there was a policy allowing `ingress-ns` to access Secrets in the `ns-name` namespace.
	SecretAllowed(resourceName string, namespace string) bool
}

// OutboundListenerClass is a helper to turn a NodeType for outbound to a ListenerClass.
func OutboundListenerClass(t NodeType) istionetworking.ListenerClass {
	if t == Router {
		return istionetworking.ListenerClassGateway
	}

			listenerOpts.port.Port, listenerOpts.port.Protocol, currentListenerEntry.protocol, conflictType)
		return
	}

	// In general, for handling conflicts we:
	// * Turn on sniffing if its HTTP and TCP mixed
	// * Merge filter chains
	switch conflictType {
	case NoConflict, AutoOverHTTP:
		// This is a new entry (NoConflict), or completely overriding (AutoOverHTTP); add it to the map

			return nil, nil
		})

	validateFuncs = make(map[string]ValidateFunc)
)

type (
	Warning    = agent.Warning
	Validation = agent.Validation
)

// WrapWarning turns an error into a Validation as a warning
func WrapWarning(e error) Validation {
	return Validation{Warning: e}
}

func AppendValidation(v Validation, vs ...error) Validation {
	return agent.AppendValidation(v, vs...)

              - pilot-agent
              - wait
      {{- else if $nativeSidecar }}
        {{- /* preStop is called when the pod starts shutdown. Initialize drain. We will get SIGTERM once applications are torn down. */}}
        lifecycle:
          preStop:
            exec:
              command:
              - pilot-agent
              - request

              - pilot-agent
              - wait
      {{- else if $nativeSidecar }}
        {{- /* preStop is called when the pod starts shutdown. Initialize drain. We will get SIGTERM once applications are torn down. */}}
        lifecycle:
          preStop:
            exec:
              command:
              - pilot-agent
              - request

              - pilot-agent
              - wait
      {{- else if $nativeSidecar }}
        {{- /* preStop is called when the pod starts shutdown. Initialize drain. We will get SIGTERM once applications are torn down. */}}
        lifecycle:
          preStop:
            exec:
              command:
              - pilot-agent
              - request

              - pilot-agent
              - wait
      {{- else if $nativeSidecar }}
        {{- /* preStop is called when the pod starts shutdown. Initialize drain. We will get SIGTERM once applications are torn down. */}}
        lifecycle:
          preStop:
            exec:
              command:
              - pilot-agent
              - request

              - pilot-agent
              - wait
      {{- else if $nativeSidecar }}
        {{- /* preStop is called when the pod starts shutdown. Initialize drain. We will get SIGTERM once applications are torn down. */}}
        lifecycle:
          preStop:
            exec:
              command:
              - pilot-agent
              - request