secretNamespace = opt.Namespace
	}
	return client.Kube().CoreV1().Secrets(secretNamespace).Get(context.TODO(), secretName, metav1.GetOptions{})
}

func getOrCreateServiceAccount(client kube.CLIClient, opt RemoteSecretOptions) (*v1.ServiceAccount, error) {
	if sa, err := client.Kube().CoreV1().ServiceAccounts(opt.Namespace).Get(
		context.TODO(), opt.ServiceAccountName, metav1.GetOptions{}); err == nil {
		return sa, nil

    void updateScope(Artifact artifact, String scope);

    @Deprecated
    void manageArtifact(Artifact artifact, Artifact replacement);

    // TODO Use the following two instead of manageArtifact
    // TODO Remove ResolutionListenerDM interface

    // void manageArtifactVersion( Artifact artifact, Artifact replacement );

    // void manageArtifactScope( Artifact artifact, Artifact replacement );

                    "input": "nonregexquery",
                    "ctx": {"pattern": "^fixedquery$"},
                }
            ]
        }
    ) | IsDict(
        # TODO: remove when deprecating Pydantic v1
        {
            "detail": [
                {
                    "ctx": {"pattern": "^fixedquery$"},
                    "loc": ["query", "item-query"],

                    "input": "nonregexquery",
                    "ctx": {"pattern": "^fixedquery$"},
                }
            ]
        }
    ) | IsDict(
        # TODO: remove when deprecating Pydantic v1
        {
            "detail": [
                {
                    "ctx": {"pattern": "^fixedquery$"},
                    "loc": ["query", "item-query"],

1. Check k8s pod namespace against exclusion list (plugin config)
    - Config must exclude namespace that Istio control-plane is installed in (TODO: this may change, exclude at pod level is sufficient and we may want Istiod and other istio components to use ambient too)
    - If excluded, ignore the pod and return prevResult
1. Setup redirect rules for the pods:
    - Get the port list from pods definition, as well as annotations.

            "schemas": {
                "Item": {
                    "title": "Item",
                    "required": IsOneOf(
                        ["name", "description", "price", "tax"],
                        # TODO: remove when deprecating Pydantic v1
                        ["name", "price"],
                    ),
                    "type": "object",
                    "properties": {

            "schemas": {
                "Item": {
                    "title": "Item",
                    "required": IsOneOf(
                        ["name", "description", "price", "tax"],
                        # TODO: remove when deprecating Pydantic v1
                        ["name", "price"],
                    ),
                    "type": "object",
                    "properties": {

                    "input": "foo",
                    "ctx": {"expected": "'alexnet', 'resnet' or 'lenet'"},
                }
            ]
        }
    ) | IsDict(
        # TODO: remove when deprecating Pydantic v1
        {
            "detail": [
                {
                    "ctx": {"enum_values": ["alexnet", "resnet", "lenet"]},
                    "loc": ["path", "model_name"],

import java.net.URL;
import java.net.URLClassLoader;

// TODO(b/65488446): Make this a public API.
/** Utility method to parse the system class path. */
final class ClassPathUtil {
  private ClassPathUtil() {}

  /**
   * Returns the URLs in the class path specified by the {@code java.class.path} {@linkplain
   * System#getProperty system property}.
   */
  // TODO(b/65488446): Make this a public API.

        resultData.setEncoding(charsetName);
    }

    protected String getResultDataHeader() {
        // TODO support other type
        return "<?xml version=\"1.0\"?>\n<doc>\n";
    }

    protected String getResultDataBody(final String name, final String value) {
        // TODO support other type
        // TODO trim(default)