// * originalPod: the pod before injection. If needed, we will apply some configurations from this pod on top of the final pod
// * templatePod: the rendered injection template. This is needed only to see what containers we injected
// * finalPod: the current result of injection, roughly equivalent to the merging of originalPod and templatePod

		if err != nil {
			return nil, nil, fmt.Errorf("failed applying injection overlay: %v", err)
		}
		// This is a bit of a weird hack. With NativeSidecars, the container will be under initContainers in the template pod.
		// But we may have injection customizations (https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#customizing-injection);
		// these will be in the `containers` field.

		name     string
		pod      *corev1.Pod
		expected bool
	}{
		{
			name: "Injection disabled by annotation",
			pod: &corev1.Pod{
				ObjectMeta: metav1.ObjectMeta{
					Annotations: map[string]string{
						annotation.SidecarInject.Name: "false",
					},
				},
			},
			expected: true,
		},
		{
			name: "Injection enabled by annotation",
			pod: &corev1.Pod{
				ObjectMeta: metav1.ObjectMeta{

import org.apache.maven.di.impl.InjectorImpl;

public interface Injector {

    //
    // Builder API
    //

    static Injector create() {
        return new InjectorImpl();
    }

    Injector discover(ClassLoader classLoader);

    Injector bindScope(Class<? extends Annotation> scopeAnnotation, Scope scope);

    Injector bindScope(Class<? extends Annotation> scopeAnnotation, Supplier<Scope> scope);

		inputFiles: []string{
			"testdata/injection-image-distroless-no-meshconfig.yaml",
			"testdata/common/sidecar-injector-configmap.yaml",
		},
		analyzer: &injection.ImageAnalyzer{},
		expected: []message{},
	},
	{
		name: "istioInjectionProxyImageMismatchAbsolute",
		inputFiles: []string{
			"testdata/injection-with-mismatched-sidecar.yaml",
			"testdata/sidecar-injector-configmap-absolute-override.yaml",
		},

    # always skip the injection on pods that match that label selector, regardless of the global policy.
    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
    neverInjectSelector: []
    alwaysInjectSelector: []

    # injectedAnnotations are additional annotations that will be added to the pod spec after injection

    # always skip the injection on pods that match that label selector, regardless of the global policy.
    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
    neverInjectSelector: []
    alwaysInjectSelector: []
    # injectedAnnotations are additional annotations that will be added to the pod spec after injection

apiVersion: release-notes/v2
kind: bug-fix
area: installation
docs:
- 'https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#customizing-injection'
releaseNotes:
- |

			in:   "proxy-override.yaml",
			want: "proxy-override.yaml.injected",
		},
		{
			in:   "explicit-security-context.yaml",
			want: "explicit-security-context.yaml.injected",
		},
		{
			in:   "only-proxy-container.yaml",
			want: "only-proxy-container.yaml.injected",
		},
		{
			in:   "proxy-override-args.yaml",
			want: "proxy-override-args.yaml.injected",
		},
		{
			in:   "proxy-override-runas.yaml",

  // This is primarily to support PSP annotations.
  google.protobuf.Struct injectedAnnotations = 19;

  // Enable objectSelector to filter out pods with no need for sidecar before calling istio-sidecar-injector.
  google.protobuf.Struct objectSelector = 21;

  // Configure the injection url for sidecar injector webhook
  string injectionURL = 22;