// for the pod. If this is a pod added via informer, the pod should have already gone thru
			// the CNI plugin chain, and have a PodIP.
			//
			// If PodIPs exists, it is preferred, otherwise fallback to PodIP.
			//
			// If we get to this point and have a pod that really and truly has no IP in either of those,

  // fails, one of the conditions will have type "Failed" and status true. When
  // a Job is suspended, one of the conditions will have type "Suspended" and
  // status true; when the Job is resumed, the status of this condition will
  // become false. When a Job is completed, one of the conditions will have
  // type "Complete" and status true.

```

TODO. It is possible to add Istio-CNI later, and gradually migrate.

### Install Control plane

This can run in any cluster. A mesh should have at least one cluster should run Pilot or equivalent XDS server,
and it is recommended to have Pilot running in each region and in multiple availability zones for multi cluster.

```bash
iop istio-control istio-discovery $IBASE/istio-control/istio-discovery \

```console
helm delete ztunnel
```

## Configuration

To view support configuration options and documentation, run:

```console
helm show values istio/ztunnel
```

### Profiles

Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
These can be set with `--set profile=<profile>`.

  // value represents the integer value of this priority class. This is the actual priority that pods
  // receive when they have the name of this class in their pod spec.
  optional int32 value = 2;

  // globalDefault specifies whether this PriorityClass should be considered as
  // the default priority for pods that do not have any priority class.
  // Only one PriorityClass can be marked as `globalDefault`. However, if more than

	}

	if c.shouldFail {
		if fErr == nil {
			t.Fatalf("Command should have failed for 'istioctl %s', didn't get one, output was %q",
				c.args, output)
		}
	} else {
		if fErr != nil {
			t.Fatalf("Command should not have failed for 'istioctl %s': %v", c.args, fErr)
		}
	}

// we actually may have them before K8S in the Pod object.
func (s *NetServer) AddPodToMesh(ctx context.Context, pod *corev1.Pod, podIPs []netip.Addr, netNs string) error {
	log.Infof("in pod mode - adding pod %s/%s to ztunnel ", pod.Namespace, pod.Name)
	// make sure the cache is aware of the pod, even if we don't have the netns yet.
	s.currentPodSnapshot.Ensure(string(pod.UID))

func getPodNetNs(pod *corev1.Pod) (string, error) {
	// First, find the network namespace id by looking the interface with the given Pod IP.
	// This could break on some platforms if they do not have an interface-per-pod.
	wantID, err := findNetworkIDByIP(pod.Status.PodIP)
	if err != nil {
		return "", fmt.Errorf("network id: %v", err)
	}
	fs, err := procfs.NewFS("/host/proc")
	if err != nil {

// ClusterTrustBundles by default.  Users who only have namespace-level access
// to a cluster can read ClusterTrustBundles by impersonating a serviceaccount
// that they have access to.
//
// It can be optionally associated with a particular assigner, in which case it
// contains one valid set of trust anchors for that signer. Signers may have

message IngressClassSpec {
  // controller refers to the name of the controller that should handle this
  // class. This allows for different "flavors" that are controlled by the
  // same controller. For example, you may have different parameters for the
  // same implementing controller. This should be specified as a
  // domain-prefixed path no more than 250 characters in length, e.g.
  // "acme.io/ingress-controller". This field is immutable.