return nil
	}

	repairLog.Infof("Labeling pod %s/%s with label %s=%s", pod.Namespace, pod.Name, c.cfg.LabelKey, c.cfg.LabelValue)

	patchBytes := fmt.Sprintf(`{"metadata":{"labels":{%q:%q}}}`, c.cfg.LabelKey, c.cfg.LabelValue)
	// Both "pods" and "pods/status" can mutate the metadata. However, pods/status is lower privilege, so we use that instead.

  // pod-1, etc) and the controller will wait until each pod is ready before
  // continuing. When scaling down, the pods are removed in the opposite order.
  // The alternative policy is `Parallel` which will create pods in parallel
  // to match the desired scale without waiting, and on scale down will delete
  // all pods at once.
  // +optional
  optional string podManagementPolicy = 6;

  // resource metric across all relevant pods, represented as a percentage of
  // the requested value of the resource for the pods.
  // +optional
  optional int32 targetAverageUtilization = 2;

  // targetAverageValue is the target value of the average of the
  // resource metric across all relevant pods, as a raw value (instead of as
  // a percentage of the request), similar to the "pods" metric source type.
  // +optional

  // that should be running the daemon pod (i.e. status.desiredNumberScheduled)
  // can have their pods stopped for an update at any given time. The update
  // starts by stopping at most 30% of those DaemonSet pods and then brings
  // up new DaemonSet pods in their place. Once the new pods are available,
  // it then proceeds onto other DaemonSet pods, thus ensuring that at least

  //   * increase no more than 4 pods per 60 seconds
  //   * double the number of pods per 60 seconds
  // No stabilization is used.
  // +optional
  optional HPAScalingRules scaleUp = 1;

  // scaleDown is scaling policy for scaling Down.
  // If not set, the default value is to allow to scale down to minReplicas pods, with a
  // 300 second stabilization window (i.e., the highest recommendation for

  // A null selector selects no pods.
  // An empty selector ({}) also selects no pods, which differs from standard behavior of selecting all pods.
  // In policy/v1, an empty selector will select all pods in the namespace.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 2;

  // An eviction is allowed if at most "maxUnavailable" pods selected by

  // pod-1, etc) and the controller will wait until each pod is ready before
  // continuing. When scaling down, the pods are removed in the opposite order.
  // The alternative policy is `Parallel` which will create pods in parallel
  // to match the desired scale without waiting, and on scale down will delete
  // all pods at once.
  // +optional
  optional string podManagementPolicy = 6;

func (s *InformerHandlers) GetActiveAmbientPodSnapshot() []*corev1.Pod {
	var pods []*corev1.Pod
	for _, pod := range s.pods.List(metav1.NamespaceAll, klabels.Everything()) {
		ns := s.namespaces.Get(pod.Namespace, "")
		if ns == nil {
			log.Warnf("failed to find namespace %s for pod %s", pod.Namespace, pod.Name)
		}

		// Exclude ztunnels, and terminated daemonset pods
		// from the snapshot.

  //   * increase no more than 4 pods per 60 seconds
  //   * double the number of pods per 60 seconds
  // No stabilization is used.
  // +optional
  optional HPAScalingRules scaleUp = 1;

  // scaleDown is scaling policy for scaling Down.
  // If not set, the default value is to allow to scale down to minReplicas pods, with a
  // 300 second stabilization window (i.e., the highest recommendation for

  // An empty podSelector matches all pods in this namespace.
  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector podSelector = 1;

  // ingress is a list of ingress rules to be applied to the selected pods.
  // Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod
  // (and cluster policy otherwise allows the traffic), OR if the traffic source is