EnableCDSCaching = env.Register("PILOT_ENABLE_CDS_CACHE", true,
		"If true, Pilot will cache CDS responses. Note: this depends on PILOT_ENABLE_XDS_CACHE.").Get()

	// EnableRDSCaching determines if RDS caching is enabled. This is explicitly split out of ENABLE_XDS_CACHE,
	// so that in case there are issues with the RDS cache we can just disable the RDS cache.

	if !isSecureMode() {
		return
	}

	// When secure mode is enabled, we do one thing: enforce specific
	// environment variable values (currently we only force GOTRACEBACK=none)
	//
	// Other packages may also disable specific functionality when secure mode
	// is enabled (determined by using linkname to call isSecureMode).

	secureEnv()
}

func secureEnv() {
	var hasTraceback bool
	for i := 0; i < len(envs); i++ {

	// if Proxy addon is not disable then add the image
	if cfg.Proxy.Disabled {
		klog.V(1).Infof("skipping the kube-proxy image pull since the bundled addon is disabled")
	} else {
		images = append(images, GetKubernetesImage(constants.KubeProxy, cfg))
	}
	// if DNS addon is not disable then add the image
	if cfg.DNS.Disabled {

	}
	return Compare(Lang(v), Lang(release)) >= 0
}

// Before reports whether the file version v is strictly before a Go release.
//
// Use this predicate to disable a behavior once a certain Go release
// has happened (and stays enabled in the future).
func Before(v, release string) bool {
	if v == Future {
		return false // an unknown future version happens after y.
	}

	"istio.io/istio/cni/pkg/scopes"
	"istio.io/istio/pkg/kube"
)

var repairLog = scopes.CNIAgent

func StartRepair(ctx context.Context, cfg config.RepairConfig) {
	if !cfg.Enabled {
		repairLog.Info("CNI repair is disable.")
		return
	}
	repairLog.Info("Start CNI race condition repair.")

	client, err := clientSetup()
	if err != nil {
		repairLog.Fatalf("CNI repair could not construct clientSet: %s", err)
	}

// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
// THE SOFTWARE.

package arm

		Hidden: true,
	},
	cli.StringFlag{
		Name:  "certs-dir, S",
		Value: defaultCertsDir.Get(),
		Usage: "path to certs directory",
	},
	cli.BoolFlag{
		Name:  "quiet",
		Usage: "disable startup and info messages",
	},
	cli.BoolFlag{
		Name:  "anonymous",
		Usage: "hide sensitive information from logging",
	},
	cli.BoolFlag{
		Name:  "json",
		Usage: "output logs in JSON format",
	},

	ARM64.HasSHA512 = isSet(HWCap, hwcap_SHA512)

	// The Samsung S9+ kernel reports support for atomics, but not all cores
	// actually support them, resulting in SIGILL. See issue #28431.
	// TODO(elias.naur): Only disable the optimization on bad chipsets on android.
	ARM64.HasATOMICS = isSet(HWCap, hwcap_ATOMICS) && os != "android"

	// Check to see if executing on a Neoverse core and in order to do that,

	runtime.RaceAcquire(addr)
}

func Release(addr unsafe.Pointer) {
	runtime.RaceRelease(addr)
}

func ReleaseMerge(addr unsafe.Pointer) {
	runtime.RaceReleaseMerge(addr)
}

func Disable() {
	runtime.RaceDisable()
}

func Enable() {
	runtime.RaceEnable()
}

func Read(addr unsafe.Pointer) {
	runtime.RaceRead(addr)
}

func Write(addr unsafe.Pointer) {
	runtime.RaceWrite(addr)

	// This annotation is beta-level and is only honored when PodDeletionCost feature is enabled.
	PodDeletionCost = "controller.kubernetes.io/pod-deletion-cost"

	// DeprecatedAnnotationTopologyAwareHints can be used to enable or disable
	// Topology Aware Hints for a Service. This may be set to "Auto" or
	// "Disabled". Any other value is treated as "Disabled". This annotation has
	// been deprecated in favor of the "service.kubernetes.io/topology-mode"