if err != nil {
			t.Fatal(err)
		}
		if p.Annotations[constants.AmbientRedirection] == constants.AmbientRedirectionEnabled {
			return
		}
		time.Sleep(1 * time.Second)
	}
	t.Fatal("Pod not annotated")
}

func assertPodNotAnnotated(t *testing.T, client kube.Client, pod *corev1.Pod) {
	for i := 0; i < 5; i++ {

// sure the netns is closed eventually.
func assertNSClosed(t *testing.T, closed *atomic.Bool) {
	for i := 0; i < 5; i++ {
		if closed.Load() {
			return
		}
		time.Sleep(1 * time.Second)
	}
	t.Fatal("NS not closed")

			revision:       "canary",
		},
		{ // case 7: supplying type that doesn't select pods should fail
			args:          strings.Split("serviceaccount/sleep", " "),
			wantException: true,
		},
	}
	multixds.GetXdsResponse = func(_ *discovery.DiscoveryRequest, _ string, _ string, _ clioptions.CentralControlPlaneOptions, _ []grpc.DialOption,

			wantException:  true,
		},
		{ // supplying type that doesn't select pods should fail
			args:           strings.Split("listeners serviceaccount/sleep", " "),
			expectedString: `"serviceaccount/sleep" does not refer to a pod`,
			wantException:  true,
		},
		{ // supplying valid pod name retrieves Envoy config (fails because we don't check in Envoy config unit tests)

		if err != nil {
			return err
		}
		log.Warnf("got an event for pod %s in namespace %s not found in current pod cache, retry %d of %d",
			addCmd.PodName, addCmd.PodNamespace, retries, maxStaleRetries)
		time.Sleep(time.Duration(msInterval) * time.Millisecond)
	}

	if ambientPod == nil {
		return fmt.Errorf("got event for pod %s in namespace %s but could not find in pod cache after retries", addCmd.PodName, addCmd.PodNamespace)
	}

		pi, k8sErr = getK8sPodInfo(kClient, podName, podNamespace)
		if k8sErr == nil {
			break
		}
		log.Debugf("Failed to get %s/%s pod info: %v", podNamespace, podName, k8sErr)
		time.Sleep(podRetrievalInterval)
	}
	if k8sErr != nil {
		log.Errorf("Failed to get %s/%s pod info: %v", podNamespace, podName, k8sErr)
		return k8sErr
	}