assert.Equal(t, ztunnelServer.deletedPods.Load(), 1)
	assert.Equal(t, nlDeps.DelInpodMarkIPRuleCnt.Load(), 1)
	assert.Equal(t, nlDeps.DelLoopbackRoutesCnt.Load(), 1)
	// make sure the uid was taken from cache and netns closed
	netns := fixture.podNsMap.Take(string(pod.UID))
	assert.Equal(t, nil, netns)

	// run gc to clean up ns:

	//revive:disable-next-line:call-to-gc Just a test that we are cleaning up the netns

  // This can be used to provide different probe parameters at the beginning of a Pod's lifecycle,
  // when it might take a long time to load data or warm a cache, than during steady-state operation.
  // This cannot be updated.
  // More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
  // +optional
  optional Probe startupProbe = 22;

	found := false
	snap := p.ReadCurrentPodSnapshot()
	for k, v := range snap {
		if k == "123" && v == (WorkloadInfo{}) {
			found = true
		}
	}
	if !found {
		t.Fatalf("expected pod 123 to be in the cache")
	}
}

func TestUpsertPodCacheWithLiveNetns(t *testing.T) {
	p := newPodNetnsCache(openNsTestOverride)

	pod := &corev1.Pod{ObjectMeta: metav1.ObjectMeta{UID: "testUID"}}
	ns := newFakeNsInode(inc(), 1)

	controllruntimelog "sigs.k8s.io/controller-runtime/pkg/log"

	"istio.io/istio/istioctl/pkg/install/k8sversion"
	"istio.io/istio/operator/pkg/apis/istio/v1alpha1"
	"istio.io/istio/operator/pkg/cache"
	"istio.io/istio/operator/pkg/helmreconciler"
	"istio.io/istio/operator/pkg/manifest"
	"istio.io/istio/operator/pkg/name"
	"istio.io/istio/operator/pkg/util/clog"
	"istio.io/istio/pkg/kube"
	"istio.io/istio/pkg/log"
)

# limitations under the License.

shopt -s globstar
set -e

SCRIPTPATH=$( cd "$(dirname "$0")" && pwd -P )
ROOTDIR=$SCRIPTPATH/..
cd "$ROOTDIR" || exit

# rely on go build cache
ISTIOCTL=bin/istioctl
go build -o $ISTIOCTL ./istioctl/cmd/istioctl

for f in samples/**/*.yaml; do
  if grep -q -e "{{" "$f" ; then
    echo "Skipping check for helm template $f"
    continue
  else

There are a few ways to prevent these:

   1. The most common method (pictured above) is to sign a new certificate by calling the configured CA. Typically, this is Istiod.
   1. If the certificate is not yet expired, the `SecretManager` also can return a cache response. In practice, this would
       only happen in cases where Envoy were to re-request a resource, which is fairly rare.
   1. `SecretManager` can also read certificates from files. When this is configured, no CA client is used.

            "type": "prometheus",
            "uid": "${datasource}"
          },
          "expr": "avg(envoy_wasm_remote_load_cache_entries)",
          "interval": "",
          "legendFormat": "entries",
          "refId": "A"
        }
      ],
      "title": "Cache Entry",
      "type": "timeseries"
    },
    {
      "datasource": {
        "type": "prometheus",
        "uid": "${datasource}"

		}
		log.Warnf("got an event for pod %s in namespace %s not found in current pod cache, retry %d of %d",
			addCmd.PodName, addCmd.PodNamespace, retries, maxStaleRetries)
		time.Sleep(time.Duration(msInterval) * time.Millisecond)
	}

	if ambientPod == nil {
		return fmt.Errorf("got event for pod %s in namespace %s but could not find in pod cache after retries", addCmd.PodName, addCmd.PodNamespace)
	}