Note: most resources have a suffix automatically added in addition.
      In the old chart, this was `-{{ .Values.global.istioNamespace }}`.

	// secret, and replace the env variable value with it. When ECDS config update reaches the proxy,
	// agent will extract out the secret from env variable, use it for image pulling, and strip the
	// env variable from VM config before forwarding it to envoy.
	envs := pluginConfig.GetVmConfig().GetEnvironmentVariables().GetKeyValues()
	secretName := envs[model.WasmSecretEnv]

		// Anything other than "file not found" is an error.
		return nil, fmt.Errorf("failed to remove unix://%s: %v", path, err)
	}

	// Attempt to create the folder in case it doesn't exist
	if err := os.MkdirAll(filepath.Dir(path), 0o750); err != nil {
		// If we cannot create it, just warn here - we will fail later if there is a real error
		log.Warnf("Failed to create directory for %v: %v", path, err)
	}

	var err error

  // +optional
  repeated ImageReviewContainerSpec containers = 1;

  // Annotations is a list of key-value pairs extracted from the Pod's annotations.
  // It only includes keys which match the pattern `*.image-policy.k8s.io/*`.
  // It is up to each webhook backend to determine how to interpret these annotations, if at all.
  // +optional
  map<string, string> annotations = 2;

				if err == nil && s != nil && s.IsDir() {
					// If it's a directory, add a watch for it so we see nested files.
					if e.Op&fsnotify.Create != 0 {
						log.Debugf("add watch for %v: %v", s.Name(), watcher.watchRecursive(e.Name))
					}
				}
				// Can't stat a deleted directory, so attempt to remove it. If it fails it is not a problem
				if e.Op&fsnotify.Remove != 0 {
					_ = watcher.Remove(e.Name)
				}

				"domain or its aliases", trustDomainFromPrincipal, principal)
			// when SkipValidateTrustDomain is being used the message isn't very meaningful so we'll log it at a lower level
			// logging it at this level may help users who are looking to disable skipping validation understand if it's safe
			if !features.SkipValidateTrustDomain {
				authzLog.Warn(msg)
			} else {
				authzLog.Debug(msg)
			}

	return s.logCallers.Load().(bool)
}

// copy makes a copy of s and returns a pointer to it.
func (s *Scope) copy() *Scope {
	out := *s
	out.labels = copyStringInterfaceMap(s.labels)
	return &out
}

// WithLabels adds a key-value pairs to the labels in s. The key must be a string, while the value may be any type.
// It returns a copy of s, with the labels added.

	"go.uber.org/atomic"
)

// SetForTest sets a variable for the duration of a test, then resets it once the test is complete.
func SetForTest[T any](t Failer, vv *T, v T) {
	old := *vv
	*vv = v
	t.Cleanup(func() {
		*vv = old
	})
}

// SetEnvForTest sets an environment variable for the duration of a test, then resets it once the test is complete.
func SetEnvForTest(t Failer, k, v string) {
	old, oldset := os.LookupEnv(k)

// in a pod, we cannot just access any arbitrary file they happen to bind mount in, as we don't know ahead of time where
// it might be.
//
// Instead, we rely directly on the procfs.
// This rules out two possible methods:
// * use crictl to inspect the pod; this returns the bind-mounted network namespace file.

	// have started, they will not go back in the life time of Envoy process.
	// They will only change at hot restart or health check fails. Since istio
	// does not use both of them, it is safe to cache this value. Since the
	// actual readiness probe goes via Envoy, it ensures that Envoy is actively
	// serving traffic and we can rely on that.
	if p.atleastOnceReady {
		return nil
	}

	err := checkEnvoyStats(p.LocalHostAddr, p.AdminPort)