* For large API changes, 2 members of the TOC must approve the PR before release manager approval in the release branch
  of the istio/api repository. This does not have to wait for the weekly TOC meeting.
    * Risk should be assessed in the PR.
        * Have installs and upgrades affected by this feature?
        * Is the feature still being worked on?
        * Is the default behavior altered?

	assert.Equal(t, len(fds), 1)
	// in theory we should close the fd, but it's just a test..

	assert.Equal(t, m.Payload.(*zdsapi.WorkloadRequest_Add).Add.Uid, uid)
	// send ack so the server doesn't wait for us.
	sendAck(ztunClient)

	// second message should be the snap sent message
	m, fds = readRequest(t, ztunClient)
	assert.Equal(t, len(fds), 0)

	// CRDs are not in the prune list, but must be considered for tests.
	allClusterGVKs = helmreconciler.ClusterResources
)

func init() {
	if kubeBuilderInstalled() {
		// TestMode is required to not wait in the go client for resources that will never be created in the test server.
		helmreconciler.TestMode = true
		// Add install and controller to the list of commands to run tests against.

		wg.Add(1)
		go func(si *ScopeInfo) {
			defer wg.Done()
			err := c.PutScope(si)
			ch <- struct {
				err       error
				scopeName string
			}{err: err, scopeName: si.Name}
		}(scope)
	}
	wg.Wait()
	close(ch)
	for result := range ch {
		if result.err != nil {
			return fmt.Errorf("failed updating Scope %s: %v", result.scopeName, result.err)
		}
	}
	return nil
}

istioctl manifest generate -o istio_manifests
```

Use depth first search to traverse the created directory hierarchy when applying your YAML files. This is needed for
correct sequencing of dependencies. Child manifest directories must wait for their parent directory to be fully applied,
but not their sibling manifest directories.

#### Just apply it for me

value: {{.Values.watchedNamespaces | quote}} - name: LEADER_ELECTION_NAMESPACE value: {{.Release.Namespace | quote}} - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: OPERATOR_NAME value: {{.Release.Namespace | quote}} - name: WAIT_FOR_RESOURCES_TIMEOUT value: {{.Values.waitForResourcesTime | quote}} - name: REVISION value: {{.Values.revision | quote}} {{- with .Values.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} {{- end }} {{- with .Values.affinity }} affinity:...

			constants.DataplaneModeLabel, constants.DataplaneModeAmbient)), metav1.PatchOptions{})
	assert.NoError(t, err)

	// wait for an update event
	mt.Assert(EventTotals.Name(), map[string]string{"type": "update"}, monitortest.AtLeast(2))

	// wait for the pod to be annotated
	// after Pod annotated, another update event will be triggered.
	assertPodAnnotated(t, client, pod)

	viper.Set(constants.LogUDSAddress, "")
	viper.Set(constants.RepairEnabled, false)

	ctx, cancel := context.WithCancel(context.Background())
	wg := sync.WaitGroup{}
	wg.Add(1)
	defer func() {
		cancel()
		wg.Wait()
	}()
	go func() {
		runInstall(ctx, tempCNIConfDir, tempCNIBinDir, tempK8sSvcAcctDir, envPreconf, filepath.Join(env.IstioSrc, "cni/test/testdata/bindir"), chainedCNIPlugin, t)
		wg.Done()
	}()

              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: OPERATOR_NAME
              value: {{.Release.Namespace | quote}}
            - name: WAIT_FOR_RESOURCES_TIMEOUT
              value: {{.Values.waitForResourcesTimeout | quote}}
            - name: REVISION
              value: {{.Values.revision | quote}}
      {{- with .Values.nodeSelector }}
      nodeSelector:

		installLog.Infof("Waiting for CNI network config file to be written in %v...", cfg.mountedCNINetDir)
		if err := watcher.Wait(ctx); err != nil {
			return "", err
		}
	}

	cniConfigFilepath := filepath.Join(cfg.mountedCNINetDir, filename)

	for !file.Exists(cniConfigFilepath) {