log.Debug("netns inode mismatch, using the new one")
	}

	p.addToCacheUnderLock(uid, workload)
	return workload.Netns
}

// Update the cache with the given uid and nspath. Return the Netns for the given uid.
// If uid is already present, a cached Netns is returned, and the given nspath is ignored.
func (p *podNetnsCache) Get(uid string) Netns {
	// lock current snapshot pod map
	p.mu.RLock()
	defer p.mu.RUnlock()

func isControllerInstalled(cs kubernetes.Interface, operatorNamespace string, revision string) (bool, error) {
	orn := operatorResourceName
	if revision != "" {
		orn += "-" + revision
	}
	return deploymentExists(cs, operatorNamespace, orn)
}

// renderOperatorManifest renders a manifest to install the operator with the given input arguments.

		want *istiodConfigLog
	}{
		{
			name: "given --reset flag return reset command",
			args: args{
				ctrzClient:      ctrzClient,
				reset:           true,
				outputLogLevel:  "",
				stackTraceLevel: "",
				outputFormat:    "",
			},
			want: &istiodConfigLog{state: &resetState{
				client: ctrzClient,
			}},
		},
		{
			name: "given --level flag return outputLogLevel command",
			args: args{

	if len(routes) == 0 {
		return nil, fmt.Errorf("no routes found for %s", ip)
	}

	linkIndex := routes[0].LinkIndex
	return netlink.LinkByIndex(linkIndex)
}

// getPodNetNs finds the network namespace for a given pod. There is not a great way to do this. Network namespaces live
// under the procfs, /proc/<pid>/ns/net. In majority of cases, this is not used directly, but is rather bind mounted to

	cmd := &cobra.Command{
		Use:   "check-inject [<type>/]<name>[.<namespace>]",
		Short: "Check the injection status or inject-ability of a given resource, explains why it is (or will be) injected or not",
		Long: `
Checks associated resources of the given resource, and running webhooks to examine whether the pod can be or will be injected or not.`,
		Example: `  # Check the injection status of a pod

		}
		if err := RenderToDir(manifests, mgArgs.OutFilename, args.DryRun, l); err != nil {
			return err
		}
	}

	return nil
}

// orderedManifests generates a list of manifests from the given map sorted by the default object order
// This allows
func orderedManifests(mm name.ManifestMap) ([]string, error) {
	var rawOutput []string
	var output []string
	for _, mfs := range mm {

	})
	if err != nil {
		return nil, err
	}
	return webhooks.Items, nil
}

// GetNamespacesWithTag retrieves all namespaces pointed at the given tag.
func GetNamespacesWithTag(ctx context.Context, client kubernetes.Interface, tag string) ([]string, error) {
	namespaces, err := client.CoreV1().Namespaces().List(ctx, metav1.ListOptions{

)

// Analyzer that can be used to check authorization policy.
type Analyzer struct {
	listenerDump *envoy_admin.ListenersConfigDump
}

// NewAnalyzer creates a new analyzer for a given pod based on its envoy config.
func NewAnalyzer(envoyConfig *configdump.Wrapper) (*Analyzer, error) {
	listeners, err := envoyConfig.GetDynamicListenerDump(true)
	if err != nil {

	mt.Assert(ztunnelConnected.Name(), nil, monitortest.Exactly(1))

	// we should get the fd to dev null. note that we can't assert the fd number
	// as the kernel may have given us a different number that refers to the same file.
	assert.Equal(t, len(fds), 1)
	// in theory we should close the fd, but it's just a test..

	assert.Equal(t, m.Payload.(*zdsapi.WorkloadRequest_Add).Add.Uid, uid)

	// CLIClientWithRevision returns a client for the given revision
	CLIClientWithRevision(rev string) (kube.CLIClient, error)
	// InferPodInfoFromTypedResource returns the pod name and namespace for the given typed resource
	InferPodInfoFromTypedResource(name, namespace string) (pod string, ns string, err error)
	// InferPodsFromTypedResource returns the pod names and namespace for the given typed resource