expectPodAddedToIPSet(fakeIPSetDeps, podIP, pod.ObjectMeta)

	err := m.AddPodToMesh(fakeCtx, pod, podIPs, "")
	assert.NoError(t, err)

	fakeIPSetDeps.AssertExpectations(t)

	pod, err = fakeClientSet.CoreV1().Pods("test").Get(fakeCtx, "test", metav1.GetOptions{})
	assert.NoError(t, err)
	assert.Equal(t, len(pod.Annotations), 1)

		UID:       "123",
	}
	podIP := netip.MustParseAddr("99.9.9.9")
	podIPs := []netip.Addr{podIP}

	err := netServer.AddPodToMesh(ctx, &corev1.Pod{ObjectMeta: podMeta}, podIPs, "fakenetns")
	assert.NoError(t, err)
	assert.Equal(t, 1, ztunnelServer.addedPods.Load())
}

func TestServerRemovePod(t *testing.T) {
	ctx, cancel := context.WithCancel(context.Background())
	defer cancel()
	setupLogging()

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			mt := monitortest.New(t)
			tt.config.LabelPods = true
			c, err := NewRepairController(tt.client, tt.config)
			assert.NoError(t, err)
			t.Cleanup(func() {
				assert.NoError(t, c.queue.WaitForClose(time.Second))
			})
			stop := test.NewStop(t)
			tt.client.RunAndWait(stop)
			go c.Run(stop)
			kube.WaitForCacheSync("test", stop, c.queue.HasSynced)

		label.IoIstioDataplaneMode.Name, constants.DataplaneModeAmbient))
	_, err := client.Kube().CoreV1().Namespaces().Patch(ctx, ns.Name,
		types.MergePatchType, labelsPatch, metav1.PatchOptions{})
	assert.NoError(t, err)

	waitForMockCalls()

	assertPodAnnotated(t, client, pod)

	// Assert expected calls actually made
	fs.AssertExpectations(t)
}

func TestExistingPodAddedWhenDualStack(t *testing.T) {

		user := &User{Name: fmt.Sprintf("User%d", i), ManagerID: &manager.ID}
		DB.Create(user)
		userIDs = append(userIDs, user.ID)
	}

	var entries []User
	assert.NotPanics(t, func() {
		assert.NoError(t,
			DB.Debug().Preload("Manager.Team").
				Joins("Manager.Company").
				Find(&entries).Error)
	})
}

func TestJoinsPreload_Issue7013_RelationEmpty(t *testing.T) {
	type (
		Furniture struct {

		Revision: "default",
	}

	_, err := Generate(context.TODO(), fakeClient, opts, "istio-system")
	assert.NoError(t, err)

	wh, err := fakeClient.Kube().AdmissionregistrationV1().MutatingWebhookConfigurations().
		Get(context.Background(), "istio-sidecar-injector", metav1.GetOptions{})
	assert.NoError(t, err)

	assertFunc(t, wh.Webhooks, defaultWh.Webhooks)
}

func TestGenerateOptions(t *testing.T) {

		writeErrorResponse(ctx, w, apiErr, r.URL)
		return
	}
	sameTarget, apiErr := validateReplicationDestination(ctx, bucket, replicationConfig, &validateReplicationDestinationOptions{CheckRemoteBucket: true})
	if apiErr != noError {
		writeErrorResponse(ctx, w, apiErr, r.URL)
		return
	}
	// Validate the received bucket replication config
	if err = replicationConfig.Validate(bucket, sameTarget); err != nil {

	ctx := cli.NewFakeContext(&cli.NewFakeContextOption{
		Namespace:      c.namespace,
		IstioNamespace: c.istioNamespace,
		Results:        c.configDumps,
	})
	client, err := ctx.CLIClient()
	assert.NoError(t, err)
	// Override the Istio config factory
	for i := range c.istioConfigs {
		switch t := c.istioConfigs[i].(type) {
		case *clientnetworking.DestinationRule:

		ClientToken:   clientToken,
		ClientAddress: h.clientAddress,
		StartTime:     h.startTime,
	})
	if err != nil {
		bugLogIf(h.ctx, err)
		return nil, toAdminAPIErr(h.ctx, err), ""
	}
	return b, noError, ""
}

// PopHealStatusJSON - Called by heal-status API. It fetches the heal
// status results from global state and returns its JSON
// representation. The clientToken helps ensure there aren't

			}
			warnings, err := operatorvalidate.ParseAndValidateIstioOperator(un.Object, nil)
			if err != nil {
				return nil, err
			}
			if len(warnings) > 0 {
				return validation.Warning(warnings.ToError()), nil
			}
		}
	}

	// Didn't really validate.  This is OK, as we often get non-Istio Kubernetes YAML
	// we can't complain about.

	return nil, nil
}