createCallback.Remove("c1")
	if ok, msg := assertCallbacks(createCallback, []string{"c3", "c4", "c2"}); !ok {
		t.Errorf("callbacks tests failed, got %v", msg)
	}

	createCallback.Remove("c4")
	if ok, msg := assertCallbacks(createCallback, []string{"c3", "c2"}); !ok {
		t.Errorf("callbacks tests failed, got %v", msg)
	}

	createCallback.Remove("c2")

	for k, v := range claims {
		vStr, ok := v.(string)
		if ok {
			// Trim any LDAP specific prefix
			args[strings.ToLower(strings.TrimPrefix(k, "ldap"))] = []string{vStr}
		}
	}

	// Add groups claim which could be a list. This will ensure that the claim
	// `jwt:groups` works.
	if grpsVal, ok := claims["groups"]; ok {
		if grpsIs, ok := grpsVal.([]interface{}); ok {
			grps := []string{}

	yval := reflect.ValueOf(y)
	if xval.Kind() == reflect.Ptr && xval.IsNil() ||
		yval.Kind() == reflect.Ptr && yval.IsNil() {
		return false
	}

	if valuer, ok := x.(driver.Valuer); ok {
		x, _ = valuer.Value()
	}
	if valuer, ok := y.(driver.Valuer); ok {
		y, _ = valuer.Value()
	}
	return reflect.DeepEqual(x, y)
}

func ToString(value interface{}) string {
	switch v := value.(type) {
	case string:

		if collPath.isDescendantOf(path) {
			if v, ok := h.metricsData.mgMap[collPath]; ok {
				matchingMG[collPath] = v
			} else {
				matchingMG[collPath] = h.metricsData.bucketMGMap[collPath]
			}
		}
	}

	if len(matchingMG) == 0 {
		return nil
	}

	var metrics []metricDisplay
	for _, collectorPath := range h.metricsData.collectorPaths {
		if mg, ok := matchingMG[collectorPath]; ok {

	cpuResourceMetrics, found := resourceMetricsMap[cpuSubsystem]
	if found {
		if cpuIdleMetric, ok := cpuResourceMetrics[getResourceKey(cpuIdle, nil)]; ok {
			avgVal := math.Round(cpuIdleMetric.Avg*100) / 100
			m.Set(sysCPUAvgIdle, avgVal)
		}
		if cpuIOWaitMetric, ok := cpuResourceMetrics[getResourceKey(cpuIOWait, nil)]; ok {
			avgVal := math.Round(cpuIOWaitMetric.Avg*100) / 100
			m.Set(sysCPUAvgIOWait, avgVal)
		}
	}

		return "None"
	}

	if svc, ok := services[wl.Waypoint.Destination]; ok {
		return svc.Name
	}

	return "NA" // Shouldn't normally reach here
}

func serviceWaypointName(svc *ZtunnelService, services map[string]*ZtunnelService) string {
	if svc.Waypoint == nil {
		return "None"
	}

	if svc, ok := services[svc.Waypoint.Destination]; ok {
		return svc.Name
	}

		return info.Netns
	}
	return nil
}

// make sure uid is in the cache, even if we don't have a netns
func (p *podNetnsCache) Ensure(uid string) {
	p.mu.Lock()
	defer p.mu.Unlock()
	if _, ok := p.currentPodCache[uid]; !ok {
		p.currentPodCache[uid] = WorkloadInfo{}
	}
}

func (p *podNetnsCache) addToCacheUnderLock(uid string, workload WorkloadInfo) {
	runtime.SetFinalizer(workload.Netns, closeNetns)

				switch me.Operator {
				case metav1.LabelSelectorOpDoesNotExist:
					v, ok := podLabels[me.Key]
					if ok {
						return fmt.Sprintf("Pod has %s=%s label, preventing injection", me.Key, v), false
					}
				case metav1.LabelSelectorOpNotIn:
					v, ok := podLabels[me.Key]
					if !ok {
						continue
					}
					for _, nv := range me.Values {
						if nv == v {

	if last > defaultLogBufferCount || last <= 0 {
		last = defaultLogBufferCount
	}

	lastN = make([]log.Info, last)
	sys.RLock()
	sys.logBuf.Do(func(p interface{}) {
		if p != nil {
			lg, ok := p.(log.Info)
			if ok && lg.SendLog(node, logKind) {
				lastN[cnt%last] = lg
				cnt++
			}
		}
	})
	sys.RUnlock()
	// send last n console log messages in order filtered by node
	if cnt > 0 {

		return
	}

	byHostName := globalMinioAddr
	if len(opts.hosts) > 0 {
		server := getLocalServerProperty(globalEndpoints, &http.Request{
			Host: globalLocalNodeName,
		}, false)
		if _, ok := opts.hosts[server.Endpoint]; ok {
			byHostName = server.Endpoint
		} else {
			return
		}
	}

	if strings.HasPrefix(byHostName, ":") && !strings.HasPrefix(globalLocalNodeName, ":") {
		byHostName = globalLocalNodeName
	}