name:         "two images spread on two nodes, prefer the larger image one",
		},
		{
			// Pod: gcr.io/40 gcr.io/300

			// Node1
			// Image: gcr.io/40:latest 40MB, gcr.io/300:latest 300MB
			// Score: 100 * ((40M + 300M)/2 - 23M)/(1000M * 2 - 23M) = 7

			// Node2
			// Image: not present
			// Score: 0
			pod:          &v1.Pod{Spec: test40300},

			Requests: v1.ResourceList{
				v1.ResourceCPU:    resource.MustParse("300m"),
				v1.ResourceMemory: resource.MustParse("300Mi"),
			},
		}),
		highRequestGuaranteed: getPodWithResources(highRequestGuaranteed, v1.ResourceRequirements{
			Requests: v1.ResourceList{
				v1.ResourceCPU:    resource.MustParse("300m"),
				v1.ResourceMemory: resource.MustParse("300Mi"),
			},
			Limits: v1.ResourceList{

        - MUTUAL_TLS
        {{- else }}
        - --controlPlaneAuthPolicy
        - NONE
        {{- end }}
        - --dnsRefreshRate
        - {{ valueOrDefault .Values.global.proxy.dnsRefreshRate "300s" }}
      {{- if (ne (annotation .ObjectMeta "status.sidecar.istio.io/port" .Values.global.proxy.statusPort) "0") }}
        - --statusPort

        - MUTUAL_TLS
        {{- else }}
        - --controlPlaneAuthPolicy
        - NONE
        {{- end }}
        - --dnsRefreshRate
        - {{ valueOrDefault .Values.global.proxy.dnsRefreshRate "300s" }}
      {{- if (ne (annotation .ObjectMeta "status.sidecar.istio.io/port" .Values.global.proxy.statusPort) "0") }}
        - --statusPort

        - MUTUAL_TLS
        {{- else }}
        - --controlPlaneAuthPolicy
        - NONE
        {{- end }}
        - --dnsRefreshRate
        - {{ valueOrDefault .Values.global.proxy.dnsRefreshRate "300s" }}
      {{- if (ne (annotation .ObjectMeta "status.sidecar.istio.io/port" .Values.global.proxy.statusPort) "0") }}
        - --statusPort

        - MUTUAL_TLS
        {{- else }}
        - --controlPlaneAuthPolicy
        - NONE
        {{- end }}
        - --dnsRefreshRate
        - {{ valueOrDefault .Values.global.proxy.dnsRefreshRate "300s" }}
      {{- if (ne (annotation .ObjectMeta "status.sidecar.istio.io/port" .Values.global.proxy.statusPort) "0") }}
        - --statusPort

	}
}

func BenchmarkPopulationRetention(b *testing.B) {

	// Run with:
	// go test ./plugin/pkg/auth/authorizer/node -benchmem -bench . -run None -v -o node.test -timeout 300m

	// Evaluate retained memory with:
	// go tool pprof --inuse_space node.test plugin/pkg/auth/authorizer/node/BenchmarkPopulationRetention.profile
	// list populate

	opts := &sampleDataOpts{

kubelet_image_pull_duration_seconds_bucket{image_size_in_bytes="0-10MB",le="180"} 1
kubelet_image_pull_duration_seconds_bucket{image_size_in_bytes="0-10MB",le="240"} 1
kubelet_image_pull_duration_seconds_bucket{image_size_in_bytes="0-10MB",le="300"} 1
kubelet_image_pull_duration_seconds_bucket{image_size_in_bytes="0-10MB",le="360"} 1
kubelet_image_pull_duration_seconds_bucket{image_size_in_bytes="0-10MB",le="480"} 1

				Hostname: "pod-2",
				NodeName: pointer.String("node-2"),
			}},
		}, {
			Ports: []corev1.EndpointPort{{
				Name:     "http",
				Port:     3000,
				Protocol: corev1.ProtocolTCP,
			}, {
				Name:     "https",
				Port:     3001,
				Protocol: corev1.ProtocolUDP,
			}},
			Addresses: []corev1.EndpointAddress{{
				IP:       "10.0.1.1",
				Hostname: "pod-11",

		t.Error()
	}

	svcIP1 := "10.20.30.41"
	svcPort1 := 80
	svcNodePort1 := 3001
	svcPortName1 := proxy.ServicePortName{
		NamespacedName: makeNSN("ns1", "svc1"),
		Port:           "p80",
		Protocol:       v1.ProtocolTCP,
	}

	svcIP2 := "10.20.30.42"
	svcPort2 := 80
	svcNodePort2 := 3002
	svcPortName2 := proxy.ServicePortName{
		NamespacedName: makeNSN("ns1", "svc2"),