pod.Origins = append(pod.Origins, e.origin)
			pod.ProcessIDs = append(pod.ProcessIDs, e.pid)
		}
		pods = append(pods, pod)
	}
	slices.SortFunc(pods, func(a, b Pod) int {
		return strings.Compare(a.MetaFile, b.MetaFile)
	})
	return pods
}

func warning(s string, a ...interface{}) {
	fmt.Fprintf(os.Stderr, "warning: ")
	fmt.Fprintf(os.Stderr, s, a...)

  // An empty selector ({}) also selects no pods, which differs from standard behavior of selecting all pods.
  // In policy/v1, an empty selector will select all pods in the namespace.
  // +optional
  optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 2;

  // An eviction is allowed if at most "maxUnavailable" pods selected by
  // "selector" are unavailable after the eviction, i.e. even in absence of

	pods := []types.UID{"pod-1", "pod-2"}

	testUserNsPodsManager := &testUserNsPodsManager{
		podDir: t.TempDir(),
		// List the same pods we will record, so the second time we create the userns
		// manager, it will find these pods on disk with userns data.
		podList: pods,
	}
	m, err := MakeUserNsManager(testUserNsPodsManager)
	require.NoError(t, err)

	// Record the pods on disk.
	for _, podUID := range pods {

	// Healthy pods will be subject to the PDB for eviction.
	//
	// AlwaysAllow policy means that all running pods (status.phase="Running"),
	// but not yet healthy are considered disrupted and can be evicted regardless
	// of whether the criteria in a PDB is met. This means perspective running
	// pods of a disrupted application might not get a chance to become healthy.
	// Healthy pods will be subject to the PDB for eviction.
	//

func NewPodMustFetch(a istioKube.CLIClient, namespace string, selectors ...string) PodFetchFunc {
	return func() ([]corev1.Pod, error) {
		pods, err := a.PodsForSelector(context.TODO(), namespace, selectors...)
		if err != nil {
			return nil, err
		}
		if len(pods.Items) == 0 {
			return nil, fmt.Errorf("no pods found for %v", selectors)
		}
		return pods.Items, nil
	}
}

  // all pods within the namespace.
  // +patchStrategy=replace
  // +optional
  optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 2;

  // An eviction is allowed if at most "maxUnavailable" pods selected by
  // "selector" are unavailable after the eviction, i.e. even in absence of
  // the evicted pod. For example, one can prevent all voluntary evictions

see errors such as 404s, HTTPS connection problems, and TCP connection problems.  If
ServiceEntries are misconfigured pods may see problems with server names.

## Try it out

After an operator runs `kubectl create -f aptget.yaml` pods will be able to
succeed with `apt-get update` and `apt-get install`.

After an operator runs `kubectl create -f github.yaml` pods will be able to

		return pod.Status.StartTime
	}
	// Assumed pods and bound pods that haven't started don't have a StartTime yet.
	return &metav1.Time{Time: time.Now()}
}

// GetEarliestPodStartTime returns the earliest start time of all pods that
// have the highest priority among all victims.
func GetEarliestPodStartTime(victims *extenderv1.Victims) *metav1.Time {
	if len(victims.Pods) == 0 {
		// should not reach here.

		delete(p.pods, pod.UID)
		return
	}

	state := p.pods[pod.UID]
	if state == nil {
		// create a new record for pod, only if it was not yet acknowledged by the Kubelet
		// this is required, as we want to log metric only for those pods, that where scheduled
		// after Kubelet started
		if pod.Status.StartTime.IsZero() {
			p.pods[pod.UID] = &perPodState{}
		}

		return
	}

			return true
		}
		ns := resource.Metadata.FullName.Namespace.String()
		pods[ns] = append(pods[ns], resource.Metadata.Labels)
		return true
	})
	return pods