return
	}

	// Identity lease deletion and storageversion update don't happen too often. Start one
	// worker for each of them.
	// runLeaseWorker handles legit identity lease deletion, while runStorageVersionWorker
	// handles storageversion creation/update with non-existing id. The latter should rarely
	// happen. It's okay for the two workers to conflict on update.

		// we allow removing all client ca bundles because the server is still secure when this happens. it just means
		// that there isn't a hint to clients about which client-cert to used.  this happens when there is no client-ca
		// yet known for authentication, which can happen in aggregated apiservers and some kube-apiserver deployment modes.
		newContent.clientCA = caBundleContent{caBundle: currClientCABundle}
	}

	if config.Mode == proxyconfigapi.ProxyModeIPTables {
		logger.Info("Using iptables Proxier")

		if dualStack {
			ipt, _ := getIPTables(s.PrimaryIPFamily)

			// TODO this has side effects that should only happen when Run() is invoked.
			proxier, err = iptables.NewDualStackProxier(
				ctx,
				ipt,
				utilsysctl.New(),
				exec.New(),
				config.IPTables.SyncPeriod.Duration,

            entry_func, symtab, /*predicate*/ calls_entry_functions, calls)
            .failed()) {
      return failure();
    }
    if (!calls.empty()) {
      // This is not expected to happen in practice. We can add a pass after
      // GuaranteeAllFuncsOneUsePass to remove "tf.entry_function" or
      // "tf_saved_model.initializer_type" attribute from the callee of the
      // inner calls if the problem ever arises.

		log.Warnf("failed to sync host IPset: %v", err)
		consErr = append(consErr, err)
	}

	podsByUID := slices.GroupUnique(ambientPods, (*corev1.Pod).GetUID)
	if err := s.buildZtunnelSnapshot(podsByUID); err != nil {
		log.Warnf("failed to construct initial ztunnel snapshot: %v", err)
		consErr = append(consErr, err)
	}

	return errors.Join(consErr...)
}

	// last path component is a file, so the operation chain works..
	podResourcesDir := filepath.Base(filepath.Dir(filepath.Join(path, file)))
	if podResourcesDir == "" {
		// should not happen because the user can configure a root directory, and we expected a subdirectory inside
		// the user supplied root directory named like "pod-resources" or so.

     *  - Modification of a package
     *  - Creation of a new declaration
     *  - Moving a declaration to another package
     *
     * Generally, all modifications which happen outside the body of a callable declaration (functions, accessors, or properties) with an
     * explicit type are considered **OOBM**.
     *
     * @see ModificationTracker
     */

    fun InterpretationSchemaBuildingResult.sequenceOrError() = when (this) {
        is InterpretationSchemaBuildingResult.InterpretationSequenceAvailable -> sequence
        // This is rather an unexpected case, should not happen in normal operation.
        InterpretationSchemaBuildingResult.SchemaNotBuilt -> throw GradleException("schema not available")
    }

    private

                // Note: throw the failure rather than returning a result object containing the failure, as console failure logging based on the _result_ happens down in the root build scope

func getIntValueFromLabel(labels map[string]string, label string) (int, error) {
	if strValue, found := labels[label]; found {
		intValue, err := strconv.Atoi(strValue)
		if err != nil {
			// This really should not happen. Just set value to 0 to handle this abnormal case
			return 0, err
		}
		return intValue, nil
	}
	// Do not report error, because there should be many old containers without label now.