if err != nil {
		l.LogAndFatal(err)
	}
	if oiArgs.common.revision == "default" {
		oiArgs.common.revision = ""
	}
	// Error here likely indicates Deployment is missing. If some other K8s error, we will hit it again later.
	already, _ := isControllerInstalled(kubeClient.Kube(), oiArgs.common.operatorNamespace, oiArgs.common.revision)
	if already {

	we may need to ztunnel to send its (uid, bootid / boot time) to us
	so that we can remove stale entries when the ztunnel pod is deleted
	or when the ztunnel pod is restarted in the same pod (remove old entries when the same uid connects again, but with different boot id?)

	save a queue of what needs to be sent to the ztunnel pod and send it one by one when it connects.

	when a new ztunnel connects with different uid, only propagate deletes to older ztunnels.
*/

    }
  },
  "certificates": [
    {
      "identity": "spiffe://cluster.local/ns/istio-system/sa/istiod",
      "state": "Available",
      "certChain": [
        {

		{"-t", iptablesconstants.NAT, "-D", iptablesconstants.POSTROUTING, "-j", ChainHostPostrouting},
		// flush-then-delete our created chains
		// these sometimes fail due to "Device or resource busy" - again NBD.
		{"-t", iptablesconstants.NAT, "-F", ChainHostPostrouting},
		{"-t", iptablesconstants.NAT, "-X", ChainHostPostrouting},
	}

	// iptablei seems like a reasonable pluralization of iptables

  // Initialized as false, becomes true after startupProbe is considered
  // successful. Resets to false when the container is restarted, or if kubelet
  // loses state temporarily. In both cases, startup probes will run again.
  // Is always true when no startupProbe is defined and container is running and
  // has passed the postStart lifecycle hook. The null value must be treated the
  // same as false.
  // +optional

Envoy has stopped requested them; if there are no subscriptions they update will be ignored. If Envoy later watches these certificates again,
a new one will be generated on demand.

## Configuration

| Variable | Description |
| - | - |
|CA_ADDR|Address of CA, defaults to discoveryAddress|

		// We had a watch error - that's no good
		return err
	case <-ctx.Done():
		return ctx.Err()
	default:
		// Valid configuration; set isReady to true and wait for modifications before checking again
		setReady(in.isReady)
		cniInstalls.With(resultLabel.Value(resultSuccess)).Increment()
		// Pod set to "NotReady" before termination
		return watcher.Wait(ctx)
	}
}

    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
    reinvocationPolicy: Never
    rewriteAppHTTPProbe: true
    # Templates defines a set of custom injection templates that can be used. For example, defining:
    #
    # templates:

The MIT License (MIT)

Copyright (c) 2014 Brian Goff

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is

	log.Debugf("netns: %s", addCmd.Netns)

	// The CNI node plugin should have already checked the pod against the k8s API before forwarding us the event,
	// but we have to invoke the K8S client anyway, so to be safe we check it again here to make sure we get the same result.
	maxStaleRetries := 10
	msInterval := 10
	retries := 0
	var ambientPod *corev1.Pod
	var err error