return maps.Clone(p.currentPodCache)
}

// Remove and return the Netns for the given uid
// No need to return NetnsCloser here it will be closed automatically on GC.
// (it may be used in parallel by other parts of the code, so we want it to be used only when not used)
func (p *podNetnsCache) Take(uid string) Netns {
	// lock current pod map
	p.mu.Lock()
	defer p.mu.Unlock()

// This file was autogenerated by go-to-protobuf. Do not edit it manually!

syntax = "proto2";

package k8s.io.apimachinery.pkg.util.intstr;

// Package-wide variables from generator "generated".
option go_package = "k8s.io/apimachinery/pkg/util/intstr";

// IntOrString is a type that can hold an int32 or a string.  When used in
// JSON or YAML marshalling and unmarshalling, it produces or consumes the

  // be ready without any of its container crashing, for it to be considered
  // available. Defaults to 0 (pod will be considered available as soon as it
  // is ready).
  // +optional
  optional int32 minReadySeconds = 4;

  // DEPRECATED.
  // A sequence number representing a specific generation of the template.
  // Populated by the system. It can be set only during the creation.
  // +optional

//
// Go already sets this (https://github.com/golang/go/issues/46279).
// However, it will restore the original limit for subprocesses (Envoy):
// https://github.com/golang/go/blob/f0d1195e13e06acdf8999188decc63306f9903f5/src/syscall/rlimit.go#L14.
// By explicitly doing it ourselves, we get the limit passed through to Envoy.
//
// This function returns the new limit additionally, for convenience.

	var expireTime time.Time
	// Cert expire time by default is createTime + sc.configOptions.SecretTTL.
	// Istiod respects SecretTTL that passed to it and use it decide TTL of cert it issued.
	// Some customer CA may override TTL param that's passed to it.
	if expireTime, err = nodeagentutil.ParseCertAndGetExpiryTimestamp(certChain); err != nil {

package channels

// Heavily inspired by the private library from gRPC (https://raw.githubusercontent.com/grpc/grpc-go/master/internal/buffer/unbounded.go)
// Since it cannot be imported directly it is mirror here. Original license:
/*
 * Copyright 2019 gRPC authors.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.

  // The field is populated by the apiserver only if the
  // StorageVersionHash feature gate is enabled.
  // This field will remain optional even if it graduates.
  // +optional
  optional string storageVersionHash = 10;
}

// APIResourceList is a list of APIResource, it is used to expose the name of the
// resources supported in a specific group and version, and if the resource
// is namespaced.
message APIResourceList {

	openIDDiscoveryCfgURLSuffix = "/.well-known/openid-configuration"

	// JwtPubKeyEvictionDuration is the life duration for cached item.
	// Cached item will be removed from the cache if it hasn't been used longer than JwtPubKeyEvictionDuration or if pilot
	// has failed to refresh it for more than JwtPubKeyEvictionDuration.
	JwtPubKeyEvictionDuration = 24 * 7 * time.Hour

- for 'internal load balancer' you should deploy a separate gateway, in a different
namespace.

All ingress gateway have a "app:ingressgateway" label, used to identify it as an
ingress, and an "istio: ingressgateway$SUFFIX" label of Gateway selection.

The Gateways use "istio: ingressgateway$SUFFIX" selectors.


# Multiple gateway versions



# Using different pilot versions

	res := []T{}
	found := sets.New[Key[T]]()
	for _, c := range j.collections {
		for _, i := range c.List() {
			key := GetKey(i)
			if !found.InsertContains(key) {
				// Only keep it if it is the first time we saw it, as our merging mechanism is to keep the first one
				res = append(res, i)
			}
		}
	}
	return res
}

func (j *join[T]) Register(f func(o Event[T])) Syncer {