// It is entirely possible to get an error and be able to continue determine authorization status in spite of it.
  // For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.
  // +optional
  optional string evaluationError = 3;
}

// SubjectRulesReviewStatus contains the result of a rules check. This check can be incomplete depending on

	return nil
}

func (c *Controller) HasSynced() bool {
	if !c.queue.HasSynced() {
		log.Debug("secret controller did not sync secrets presented at startup")
		// we haven't finished processing the secrets that were present at startup
		return false
	}
	// Check all config cluster components are synced
	// c.ConfigClusterHandler.HasSynced does not work; config cluster is handle specially
	if !kube.AllSynced(c.configClusterSyncers) {

                                    type: string
                                  sni:
                                    description: SNI string to present to the server
                                      during TLS handshake.
                                    type: string
                                  subjectAltNames:

					testUpgradeFromVersion(t, v)
				})
			}
		})
}

// testUpgradeFromVersion tests an upgrade from the target version to the master version
// provided fromVersion must be present in tests/integration/pilot/testdata/upgrade for the installation to succeed
// TODO(monkeyanator) pass this a generic UpgradeFunc allowing for reuse across in-place and revisioned upgrades

something a little more weird than K8S - we also have CNI, and that is running iptables from inside a container against the host netns. The CNI container ships its _own_ iptables binaries that may differ from the host. So we have to match the rules present in the host netns (which we can see) with the correct binary we have access to (only our own baked into the container) - we cannot rely purely on the K8S logic here because we are not only concerned with a kubelet-style context.

So basically...

  // +optional
  optional Scheduling scheduling = 3;
}

// Scheduling specifies the scheduling constraints for nodes supporting a
// RuntimeClass.
message Scheduling {
  // nodeSelector lists labels that must be present on nodes that support this
  // RuntimeClass. Pods using this RuntimeClass can only be scheduled to a
  // node matched by this selector. The RuntimeClass nodeSelector is merged

				"indicating the binary size has decreased. The test will fail to ensure you update the test thresholds to ensure "+
				"the improvements are 'locked in'.", got, tt.minMb)
		}
	})
}

// If this flag is present, it means "testing" was imported by code that is built by the binary
var denylistedFlags = []string{
	"--test.memprofilerate",
}

func runBinariesTest(t *testing.T, f func(t *testing.T, name string)) {
	t.Helper()

		}
		return nil
	}, retry.Delay(time.Second), retry.Timeout(time.Second*20))
}

// TestGRPCCountMetrics tests that istio_[request/response]_messages_total are present https://github.com/istio/istio/issues/44144
// Kiali depends on these metrics
func TestGRPCCountMetrics(t *testing.T) {
	framework.NewTest(t).
		Label(label.IPv4). // https://github.com/istio/istio/issues/35835

    - "sidecar.istio.io/status" annotation is not present on the pod (created by injection of sidecar)
    - pod label "istio.io/dataplane-mode" is not "none"
- sidecar interception is enabled if:
    - "istio-init" container is not present in the pod.
    - istio-proxy container exists and

			return copiedFiles, fmt.Errorf("create CNI config file: %v", err)
		}
		in.cniConfigFilepath = cfgPath
	} else {
		installLog.Infof("valid Istio config present in node-level CNI file %s, not modifying", in.cniConfigFilepath)
	}

	return copiedFiles, nil
}

// Run starts the installation process, verifies the configuration, then sleeps.