".Spec.EphemeralContainers[0].EphemeralContainerCommon.ReadinessProbe.ProbeHandler.GRPC.Service":   `""`,
		".Spec.EphemeralContainers[0].EphemeralContainerCommon.ReadinessProbe.PeriodSeconds":               "10",
		".Spec.EphemeralContainers[0].EphemeralContainerCommon.ReadinessProbe.SuccessThreshold":            "1",
		".Spec.EphemeralContainers[0].EphemeralContainerCommon.ReadinessProbe.TimeoutSeconds":              "1",

		}
	}

	for i := range podSpec.EphemeralContainers {
		if podSpec.EphemeralContainers[i].Lifecycle == nil {
			continue
		}
		adjustLifecycle(podSpec.EphemeralContainers[i].Lifecycle)
		if podSpec.EphemeralContainers[i].Lifecycle.PreStop == nil && podSpec.EphemeralContainers[i].Lifecycle.PostStart == nil {
			podSpec.EphemeralContainers[i].Lifecycle = nil
		}
	}
}

		}
		return container
	}

	makePod := func(containers []api.Container, initContainers []api.Container, ephemeralContainers []api.EphemeralContainer) *api.PodSpec {
		return &api.PodSpec{
			Containers:          containers,
			InitContainers:      initContainers,
			EphemeralContainers: ephemeralContainers,
		}
	}

	testCases := []struct {
		gateEnabled            bool

		},
	}
	// validate enforces restrictions on secret mounts when operation==create and subresource=='' or operation==update and subresource==ephemeralcontainers"
	attrs = admission.NewAttributesRecord(pod2, nil, api.Kind("Pod").WithVersion("version"), ns, "myname", api.Resource("pods").WithVersion("version"), "ephemeralcontainers", admission.Update, &metav1.UpdateOptions{}, false, nil)
	if err := admit.Validate(context.TODO(), attrs, nil); err != nil {

					Containers: []api.Container{
						{Name: "container1"},
						{Name: "container2"},
					},
					InitContainers: []api.Container{
						{Name: "initcontainer1"},
					},
					EphemeralContainers: []api.EphemeralContainer{
						{EphemeralContainerCommon: api.EphemeralContainerCommon{Name: "debugger"}},
					},
				},
				Status: api.PodStatus{},
			},
			opts:              &api.PodLogOptions{},

		"EphemeralContainers[*].EphemeralContainerCommon.SecurityContext.ReadOnlyRootFilesystem",
		"EphemeralContainers[*].EphemeralContainerCommon.SecurityContext.RunAsGroup",
		"EphemeralContainers[*].EphemeralContainerCommon.SecurityContext.RunAsUser",
		"EphemeralContainers[*].EphemeralContainerCommon.SecurityContext.SELinuxOptions",
		"EphemeralContainers[*].EphemeralContainerCommon.SecurityContext.SeccompProfile",

							},
						},
						{
							SecurityContext: &v1.SecurityContext{
								RunAsUser: ptr.To[int64](1000),
							},
						},
					},
					EphemeralContainers: []v1.EphemeralContainer{
						{
							EphemeralContainerCommon: v1.EphemeralContainerCommon{
								SecurityContext: &v1.SecurityContext{
									RunAsUser: ptr.To[int64](1001),
								},
							},
						},

	if shouldIgnore(a) {
		return nil
	}

	pod := a.GetObject().(*api.Pod)

	if a.GetOperation() == admission.Update && a.GetSubresource() == "ephemeralcontainers" {
		return s.limitEphemeralContainerSecretReferences(pod, a)
	}

	if a.GetOperation() != admission.Create {
		// we only validate pod specs during create requests
		return nil
	}

// oldPod or newPod may be nil to signify creation or deletion.
func updateMetrics(oldPod, newPod *v1.Pod) {
	var numEC int
	if oldPod != nil {
		numEC -= len(oldPod.Spec.EphemeralContainers)
	}
	if newPod != nil {
		numEC += len(newPod.Spec.EphemeralContainers)
	}
	if numEC != 0 {
		metrics.ManagedEphemeralContainers.Add(float64(numEC))
	}
}

// updatePodsInternal replaces the given pods in the current state of the

func dropNonEphemeralContainerUpdates(newPod, oldPod *api.Pod) *api.Pod {
	pod := oldPod.DeepCopy()
	pod.Name = newPod.Name
	pod.Namespace = newPod.Namespace
	pod.ResourceVersion = newPod.ResourceVersion
	pod.UID = newPod.UID
	pod.Spec.EphemeralContainers = newPod.Spec.EphemeralContainers
	return pod
}