// CHECK:       [[pred:%.*]] = tfrt_fallback_async.predicate
  // CHECK-NEXT:  tfrt.while [[pred]] @"[[while_func_prefix:.*]]/tfrt_body_1"
  // CHECK-SAME:  (!tfrt.chain, !tfrt_fallback.tf_tensor) -> (!tfrt.chain, !tfrt_fallback.tf_tensor)
  // CHECK-NOT:   func.call
  func.func @while_test_remove_unused_results(%arg0: tensor<i32>, %arg1: tensor<i32>) -> (tensor<i32>, tensor<i32>) {

		"citadel_server_cert_chain_expiry_timestamp",
		"The unix timestamp, in seconds, when Citadel cert chain will expire. "+
			"A negative time indicates the cert is expired.",
	)
	certChainExpirySeconds = monitoring.NewDerivedGauge(
		"citadel_server_cert_chain_expiry_seconds",
		"The time remaining, in seconds, before the certificate chain will expire. "+
			"A negative value indicates the cert is expired.",
	)
)

	// Sign generates a certificate for a workload or CA, from the given CSR and cert opts.
	Sign(csrPEM []byte, opts ca.CertOpts) ([]byte, error)
	// SignWithCertChain is similar to Sign but returns the leaf cert and the entire cert chain.
	SignWithCertChain(csrPEM []byte, opts ca.CertOpts) ([]string, error)
	// GetCAKeyCertBundle returns the KeyCertBundle used by CA.
	GetCAKeyCertBundle() *util.KeyCertBundle
}

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management

issue:
  - 51377

releaseNotes:
- |

// CHECK-LABEL: func @_tfrt_fallback_init
// CHECK-SAME: {{.*}} !tfrt.chain
// CHECK: tfrt_fallback_async.createop(%arg0) key(0) device("/device:CPU:0") "tf.ParseExampleV2"()
// CHECK-SAME: Tdense = [f32, f32], dense_shapes = [#corert.shape<>, #corert.shape<>]

				t.Errorf("failed to get initial workload secret: %v", err)
			}

			// Update CA with new intermediate cert
			if err := cert.CreateCustomCASecret(t,
				"ca-cert-alt-2.pem", "ca-key-alt-2.pem",
				"cert-chain-alt-2.pem", "root-cert-alt.pem"); err != nil {
				t.Errorf("failed to update CA secret: %v", err)
			}

			// perform one retry to handle race condition where ztunnel cert is refreshed before Istiod certificates are reloaded

	reject = s.rejectCSR
	s.faultInjectLock.Unlock()
	return reject
}

// SendEmptyCert force CA server send empty cert chain.
func (s *CAServer) SendEmptyCert() {
	s.faultInjectLock.Lock()
	s.emptyCert = true
	s.faultInjectLock.Unlock()
	caServerLog.Info("force CA server to send empty cert chain")
}

func (s *CAServer) sendEmpty() bool {
	var empty bool
	s.faultInjectLock.Lock()
	empty = s.emptyCert

                onProperty(ObjectOrigin.PropertyReference(receiverOrigin, property, propertyAccess))
            }
        }

        propertyAccess.asChainOrNull()?.let { chain ->
            schema.externalObjectsByFqName[chain.asFqName()]?.let { externalObject ->
                onExternalObject(ObjectOrigin.External(externalObject, propertyAccess))
            }
        }
    }

    private

          - --bind-localhost={{ $p.Port }}
{{- end }}
{{- end }}
          - --version={{ $subset.Version }}
          - --istio-version={{ $version }}
{{- if $.TLSSettings }}
          - --crt=/etc/certs/custom/cert-chain.pem
          - --key=/etc/certs/custom/key.pem
{{- if $.TLSSettings.AcceptAnyALPN}}
          - --disable-alpn
{{- end }}
{{- else }}
          - --crt=/cert.crt
          - --key=/cert.key
{{- end }}

  {{- end }}
  CNI_NET_DIR: {{ .Values.cni.cniConfDir | default "/etc/cni/net.d" }}
  CHAINED_CNI_PLUGIN: {{ .Values.cni.chained | quote }}
  EXCLUDED_NAMESPACES: "{{ range $idx, $ns := .Values.cni.excludeNamespaces }}{{ if $idx }},{{ end }}{{ $ns }}{{ end }}"
  REPAIR_ENABLED: {{ .Values.cni.chained | quote }}
  REPAIR_LABEL_PODS: {{ .Values.cni.repair.labelPods | quote }}
  REPAIR_DELETE_PODS: {{ .Values.cni.repair.deletePods | quote }}