err := netServer.RemovePodFromMesh(ctx, pod)
	assert.NoError(t, err)
	assert.Equal(t, ztunnelServer.deletedPods.Load(), 1)
	assert.Equal(t, nlDeps.DelInpodMarkIPRuleCnt.Load(), 1)
	assert.Equal(t, nlDeps.DelLoopbackRoutesCnt.Load(), 1)
	// make sure the uid was taken from cache and netns closed
	netns := fixture.podNsMap.Take(string(pod.UID))
	assert.Equal(t, nil, netns)

	// run gc to clean up ns:

  // And when the number of eligible domains with matching topology keys equals or greater than minDomains,
  // this value has no effect on scheduling.
  // As a result, when the number of eligible domains is less than minDomains,
  // scheduler won't schedule more than maxSkew Pods to those domains.
  // If value is nil, the constraint behaves as if MinDomains is equal to 1.
  // Valid values are integers greater than 0.

	testDoAddRun(t, cniConf, testNSName, pod, ns)

	wasCalled := serverClose()
	// Pod in namespace with enabled ambient label, should be added to mesh
	assert.Equal(t, wasCalled, true)
}

func TestCmdAddAmbientEnabledOnNSServerFails(t *testing.T) {
	url, serverClose := setupCNIEventClientWithMockServer(true)

	cniConf := buildMockConf(true, url)

}

// checkResult checks if resultFile is equal to expectedFile at each tick until timeout
func checkResult(result, expected string) error {
	resultFile, err := os.ReadFile(result)
	if err != nil {
		return fmt.Errorf("couldn't read result: %v", err)
	}
	expectedFile, err := os.ReadFile(expected)
	if err != nil {
		return fmt.Errorf("couldn't read expected: %v", err)
	}
	if !bytes.Equal(resultFile, expectedFile) {

  // stabilizationWindowSeconds is the number of seconds for which past recommendations should be
  // considered while scaling up or scaling down.
  // StabilizationWindowSeconds must be greater than or equal to zero and less than or equal to 3600 (one hour).
  // If not set, use the default values:
  // - For scale up: 0 (i.e. no stabilization is done).
  // - For scale down: 300 (i.e. the stabilization window is 300 seconds long).

	}

	handlers := setupHandlers(ctx, client, server, "istio-system")
	client.RunAndWait(ctx.Done())
	disabledPod, err := handlers.GetPodIfAmbient(pod.Name, ns.Name)

	assert.NoError(t, err)
	assert.Equal(t, disabledPod, nil)
}

func TestAmbientEnabledReturnsErrorIfBogusNS(t *testing.T) {
	setupLogging()
	NodeName = "testnode"

	ctx, cancel := context.WithCancel(context.Background())
	defer cancel()

		want map[string]string
	}{
		{name: "empty", arg: []string{""}, want: map[string]string{"": ""}},
		{name: "one-valid", arg: []string{"key=value"}, want: map[string]string{"key": "value"}},
		{name: "one-valid-double-equals", arg: []string{"key==value"}, want: map[string]string{"key": "=value"}},
		{name: "one-key-only", arg: []string{"key"}, want: map[string]string{"key": ""}},
	}
	for _, tt := range tests {

message PodDisruptionBudgetStatus {
  // Most recent generation observed when updating this PDB status. DisruptionsAllowed and other
  // status information is valid only if observedGeneration equals to PDB's object generation.
  // +optional
  optional int64 observedGeneration = 1;

  // DisruptedPods contains information about pods whose eviction was

		data, err := io.ReadAll(req.Body)
		assert.NoError(t, err)

		var msg nodeagent.CNIPluginAddEvent
		err = json.Unmarshal(data, &msg)
		assert.NoError(t, err)
		assert.Equal(t, msg.PodName, testPod)
		assert.Equal(t, msg.PodNamespace, testNS)
		assert.Equal(t, msg.Netns, fakeCmdArgs.Netns)
		res.WriteHeader(http.StatusOK)
		res.Write([]byte("server happy"))
	}))
	defer func() { testServer.Close() }()

		Netns:        "/var/netns/foo",
		PodName:      "pod-bingo",
		PodNamespace: "funkyns",
	}

	payload, _ := json.Marshal(valid)

	addEvent, err := processAddEvent(payload)

	assert.NoError(t, err)
	assert.Equal(t, valid, addEvent)
}

func TestProcessAddEventBadPayload(t *testing.T) {
	valid := CNIPluginAddEvent{
		Netns:        "/var/netns/foo",
		PodName:      "pod-bingo",
		PodNamespace: "funkyns",
	}