Resources:   []string{"*"},
				},
			}},
			FailurePolicy: ptr.Of(admission.Ignore),
		}, {
			Name: "hook1",
			ClientConfig: admission.WebhookClientConfig{Service: &admission.ServiceReference{
				Namespace: namespace,
				Name:      istiod,
				Path:      &[]string{"/hook1"}[0],
			}},
			Rules: []admission.RuleWithOperations{{
				Operations: []admission.OperationType{admission.Create, admission.Update},

	runGoid atomic.Uint64
	hooks   []Hook
	running bool

	// runtime sets these for us
	Gosched func()
	Goid    func() uint64
	Throw   func(string)
)

// Add adds a new exit hook.
func Add(h Hook) {
	for !locked.CompareAndSwap(0, 1) {
		Gosched()
	}
	hooks = append(hooks, h)
	locked.Store(0)
}

// Run runs the exit hooks.
//

// being tested, hence we do want to run exit hooks when the program
// terminates.
func InitHook(istest bool) {
	// Note: hooks are run in reverse registration order, so
	// register the counter data hook before the meta-data hook
	// (in the case where two hooks are needed).
	exithook.Add(exithook.Hook{F: emitCounterData, RunOnFailure: true})
	if istest {
		exithook.Add(exithook.Hook{F: emitMetaData, RunOnFailure: true})
	} else {

		return err
	}
	s.postStartHooks[name] = postStartHookEntry{hook: hook, originatingStack: string(debug.Stack()), done: done}

	return nil
}

// AddPostStartHookOrDie allows you to add a PostStartHook, but dies on failure
func (s *GenericAPIServer) AddPostStartHookOrDie(name string, hook PostStartHookFunc) {
	if err := s.AddPostStartHook(name, hook); err != nil {
		klog.Fatalf("Error registering PostStartHook %q: %v", name, err)

package generic

import (
	"context"

	"k8s.io/apiserver/pkg/admission"
)

// Hook represents a dynamic admission hook. The hook may be a webhook or a
// policy. For webhook, the Hook may describe how to contact the endpoint, expected
// cert, etc. For policies, the hook may describe a compiled policy-binding pair.
type Hook interface {
	// All hooks are expected to contain zero or more match conditions, object

	if len(hooks) == 0 {
		fmt.Fprintf(writer, "No Istio injection hooks present.\n")
		return nil
	}

	w := new(tabwriter.Writer).Init(writer, 0, 8, 1, ' ', 0)
	fmt.Fprintln(w, "NAMESPACES\tINJECTOR-HOOK\tISTIO-REVISION\tSIDECAR-IMAGE")
	for _, hook := range hooks {

Andy Pan <******@****.***> 1699977411 +0800

			// policy itself
			relevantHooks = append(relevantHooks, PolicyInvocation[P, B, E]{
				Policy:   hook.Policy,
				Error:    hook.ConfigurationError,
				Resource: matchGVR,
				Kind:     matchGVK,
			})
			utilruntime.HandleError(hook.ConfigurationError)
			continue
		}

		for _, binding := range hook.Bindings {
			bindingAccessor := d.newBindingAccessor(binding)

	}
	for _, hook := range webhooks {
		rev := renderWithDefault(hook.GetLabels()[label.IoIstioRev.Name], DefaultRevisionName)
		tagLabel := hook.GetLabels()[IstioTagLabel]
		ri, revPresent := revisions[rev]
		if revPresent {
			if tagLabel != "" {
				ri.Webhooks = append(ri.Webhooks, &MutatingWebhookConfigInfo{
					Name:     hook.Name,
					Revision: rev,
					Tag:      tagLabel,
				})

	return trace
}

// WithClientTrace returns a new context based on the provided parent
// ctx. HTTP client requests made with the returned context will use
// the provided trace hooks, in addition to any previous hooks
// registered with ctx. Any hooks defined in the provided trace will
// be called first.
func WithClientTrace(ctx context.Context, trace *ClientTrace) context.Context {
	if trace == nil {
		panic("nil trace")
	}