mutateCertificates adds init containers and volumes for certificate management This matches the kyverno-cert-mount.yaml logic: 1. a-toolbox: copies bu

Auth is used to return the client for credential-backend API calls.

Consul returns the Consul client for this set.

DecodeJSON decodes the 'Value' present in StorageEntry.

DefaultHTTPClientV2 returns an HTTP client with sane defaults that shares a singleton HTTP client. Multiple instances returned by this function will s

HasPath returns if the prefix for the path exists regardless if it is a path (ending with /) or a prefix for a leaf node

SelectRenderer picks an EventSink based on opts and ambient state. The matrix is documented in SRD/SDD §6.4.4 and implemented row-by-row below in prio

StringPresent returns a boolean indicating if the pointer is nil, or if the pointer is pointing to the zero value..

UpdateRestoreStatus updates the status of a restore.

--- Helpers --- demoUpdateState atomically mutates demo state and broadcasts via WebSocket. Also persists to the DB catalog for crash recovery.

Generates a self-signed certificate and private key in PEM format. The certificate has SANs for `localhost` and `stargate`.

labelSelectorMatches evaluates a LabelSelector against a set of labels. A nil selector never matches. An empty selector (no matchLabels, no matchExpre

newClientForMock builds a real nvct.Client wired to the ephemeral mock.

newNVCTTestClient wires a Client to point exclusively at an httptest server for the NVCT base URL while leaving the NVCF base URL pointed somewhere in

Returns a cached token, minting a fresh one when none is cached or it is near expiry. The lock is held across the refresh so callers coalesce onto one

AllInstancesTerminatedAndReported returns if all NVCF worker instances for backend are terminated and reported to ICMS

Key returns a boolean indicating whether the given key exists in the map.

HTTPMiddleware builds a http middleware that: - Adds contexted request logger with {method,path,ip} into request.Context - Collects <latencyMetricsN

RecordModelCacheResult records a model cache operation result. result should be "success" or "failure". failureReason should be empty string for succe

SetClusterValidatorSummary atomically updates every cluster-validator metric from a single run's summary. The protocol: 1. Compute the new label tuple

Stop halts the execution of this runner and its subprocesses.

buildChiMux constructs the router from an already-validated GatewayConfig. Callers must ensure mappings have been validated (SetupConfigWithConfigPath

egressAllowsTraffic returns true when pods in srcNS (matching srcSelector) are permitted to send traffic to the destination namespace on port/proto.

getConfigValue reads configuration value with proper priority order: 1. Environment variable (highest priority - explicit user override) 2. Config fil

newConfigMapClient is an internal helper that constructs a ConfigMapClient with the default mappers plus optional ones provided by the caller.

passingToolSpec returns a BinarySpec that always reports the given version as passing.

printSummary outputs the final validation results and returns an error if the cluster is not ready.

resolveICMSURL picks the ICMS endpoint for cluster register, in priority order: 1. --icms-url flag (explicit user override). 2. NVCF_ICMS_URL env var.

validQueue builds a Queue with all resources set to the expected healthy defaults.

Fetch queries the Vault API