// otherwise identical (parallel requests, requests when earlier requests did not modify etc)
  // The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request.
  // It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.
  optional string uid = 1;

  // otherwise identical (parallel requests, requests when earlier requests did not modify etc)
  // The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request.
  // It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.
  optional string uid = 1;

			ExpectedOutput: "Error: no pods found with selector app=kiali\n",
			WantException:  true,
		},
		{ // case 9
			Args:           strings.Split("prometheus --browser=false", " "),
			ExpectedOutput: "Error: no pods found with selector app.kubernetes.io/name=prometheus\n",
			WantException:  true,
		},
		{ // case 10
			Args:           strings.Split("zipkin --browser=false", " "),
			ExpectedOutput: "Error: no pods found with selector app=zipkin\n",

# This image is a custom built debian11 distroless image with multiarchitecture support.
# It is built on the base distroless image, with iptables binary and libraries added
# The source can be found at https://github.com/istio/distroless/tree/iptables
# This version is from commit 86c4972a9f5f245cfb382c8e1e95f176d968c882.

									log.Errorf("found RBAC HTTP filter but failed to parse: %s", err)
								} else {
									parsedFC.rbacHTTP = append(parsedFC.rbacHTTP, rbacHTTP)
								}
							}
						}
					}
				case wellknown.RoleBasedAccessControl:
					rbacTCP := &rbactcp.RBAC{}
					if err := getFilterConfig(filter, rbacTCP); err != nil {
						log.Errorf("found RBAC network filter but failed to parse: %s", err)

			var buf bytes.Buffer
			a.Print(&buf)
			expectedOutput := "ACTION   AuthorizationPolicy   RULES\n"
			actualOutput := buf.String()
			if !reflect.DeepEqual(expectedOutput, actualOutput) {
				t.Errorf("Found %v, wanted %v", actualOutput, expectedOutput)
			}
		})
	}

			},
			expectPodUID:      "",
			expectContainerID: "",
			expectMsg:         "multiple container IDs found in cgroups (9bca8d63d5fa610783847915bcff0ecac1273e5b4bed3f6fa1b07350e0135961, a55d9ac3b312d8a2627824b6d6dd8af66fbec439bf4e0ec22d6d9945ad337a38)",
		},
		{
			name: "more than one pod UID in cgroups",
			cgroupPaths: []string{

    # When processing a leaf namespace Istio will search for declarations in that namespace first
    # and if none are found it will search in the root namespace. Any matching declaration found in the root namespace
    # is processed as if it were declared in the leaf namespace.
    rootNamespace: {{ .Values.meshConfig.rootNamespace | default .Values.global.istioNamespace }}

		&netlink.Route{Dst: &net.IPNet{IP: net.ParseIP(ip), Mask: net.CIDRMask(32, 32)}},
		netlink.RT_FILTER_DST)
	if err != nil {
		return nil, err
	}

	if len(routes) == 0 {
		return nil, fmt.Errorf("no routes found for %s", ip)
	}

	linkIndex := routes[0].LinkIndex
	return netlink.LinkByIndex(linkIndex)
}

// getPodNetNs finds the network namespace for a given pod. There is not a great way to do this. Network namespaces live

			err = c.Cluster.UnmarshalTo(clusterTyped)
			if err != nil {
				return nil, err
			}
			clusters = append(clusters, clusterTyped)
		}
	}
	if len(clusters) == 0 {
		return nil, fmt.Errorf("no clusters found")
	}
	sort.Slice(clusters, func(i, j int) bool {
		iDirection, iSubset, iName, iPort := safelyParseSubsetKey(clusters[i].Name)
		jDirection, jSubset, jName, jPort := safelyParseSubsetKey(clusters[j].Name)