return &c, nil
}

// WebhookParameters configures parameters for the sidecar injection
// webhook.
type WebhookParameters struct {
	// Watcher watches the sidecar injection configuration.
	Watcher Watcher

	// Port is the webhook port, e.g. typically 443 for https.
	// This is mainly used for tests. Webhook runs on the port started by Istiod.
	Port int

	Env *model.Environment

		"Number of failed outgoing requests (e.g. to a token exchange server, CA, etc.)",
	)

	numFileWatcherFailures = monitoring.NewSum(
		"num_file_watcher_failures_total",
		"Number of times file watcher failed to add watchers")

	numFileSecretFailures = monitoring.NewSum(
		"num_file_secret_failures_total",
		"Number of times secret generation failed for files",
	)

	certExpirySeconds = monitoring.NewDerivedGauge(

	string v1beta1_field = 2;
}

message ExampleResponse {
	string error  = 1;
}

// Example is a simple example service for general reference on the recommended
// kubelet plugin model and plugin watcher testing.
service Example {
	rpc GetExampleInfo(ExampleRequest) returns (ExampleResponse) {}

	close(conn.initialized)
}

// ConnectionContext is used by the RPC event loop to respond to requests and pushes.
type ConnectionContext interface {
	XdsConnection() *Connection
	Watcher() Watcher
	// Initialize checks the first request.
	Initialize(node *core.Node) error
	// Close discards the connection.
	Close()
	// Process responds to a discovery request.

	string v1beta2_field = 2;
}

message ExampleResponse {
	string error  = 1;
}

// Example is a simple example service for general reference on the recommended
// kubelet plugin model and plugin watcher testing.
service Example {
	rpc GetExampleInfo(ExampleRequest) returns (ExampleResponse) {}

	reason string
}

func (e ConfigError) Error() string {
	return e.err.Error()
}

func (e ConfigError) Reason() string {
	return e.reason
}

func LoadCABundle(caBundleWatcher *keycertbundle.Watcher) ([]byte, error) {
	caBundle := caBundleWatcher.GetCABundle()
	if err := VerifyCABundle(caBundle); err != nil {
		return nil, &ConfigError{err, "could not verify caBundle"}
	}

	return caBundle, nil
}

}

func newLeaderElection(namespace, name, electionID, revision string, perRevision bool, remote bool, client kube.Client) *LeaderElection {
	var watcher revisions.DefaultWatcher
	if features.EnableLeaderElection {
		watcher = revisions.NewDefaultWatcher(client, revision)
	}
	if name == "" {
		hn, _ := os.Hostname()
		name = fmt.Sprintf("unknown-%s", hn)
	}
	if perRevision && revision != "" {

}

func (c *Context) Watcher() xds.Watcher {
	return c.w
}

func (w *Watch) DeleteWatchedResource(string) {
	w.Lock()
	defer w.Unlock()
	w.watch = nil
}

func (w *Watch) GetWatchedResource(string) *xds.WatchedResource {
	w.Lock()
	defer w.Unlock()
	return w.watch
}

func (w *Watch) NewWatchedResource(typeURL string, names []string) {
	w.Lock()

	return append(certPEM, caCert...), caCert, nil
}

// Return signed CSR through a watcher. If no CSR is read, return nil.
func readSignedCsr(client clientset.Interface, csr string, watchTimeout time.Duration) ([]byte, error) {
	selector := fields.OneTermEqualSelector("metadata.name", csr).String()
	// Setup a List+Watch, like informers do
	// A simple Watch will fail if the cert is signed too quickly

	caBundleWatcher *keycertbundle.Watcher

	queue controllers.Queue

	namespaces kclient.Client[*v1.Namespace]
	configmaps kclient.Client[*v1.ConfigMap]

	ignoredNamespaces sets.Set[string]
}

// NewNamespaceController returns a pointer to a newly constructed NamespaceController instance.
func NewNamespaceController(kubeClient kube.Client, caBundleWatcher *keycertbundle.Watcher) *NamespaceController {