// all pods within the namespace.
  // +patchStrategy=replace
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 2;

  // An eviction is allowed if at most "maxUnavailable" pods selected by
  // "selector" are unavailable after the eviction, i.e. even in absence of
  // the evicted pod. For example, one can prevent all voluntary evictions

	var pods []*corev1.Pod
	for _, pod := range s.pods.List(metav1.NamespaceAll, klabels.Everything()) {
		ns := s.namespaces.Get(pod.Namespace, "")
		if ns == nil {
			log.Warnf("failed to find namespace %s for pod %s", pod.Namespace, pod.Name)
		}

		if !util.IsZtunnelPod(s.systemNamespace, pod) && util.PodRedirectionEnabled(ns, pod) {
			pods = append(pods, pod)
		}
	}
	return pods
}

	setupLogging()
	ctx, cancel := context.WithCancel(context.Background())
	defer cancel()

	pods := &fakePodCache{}

	pod, f := podAndNetns()
	f.Close()
	pods.pods = map[string]WorkloadInfo{
		string(pod.UID): {}, // simulate unknown netns
	}

	fixture := connectWithPods(ctx, pods)
	ztunClient := fixture.ztunClient
	// read initial pod add
	keep, fds := readRequest(t, ztunClient)

    verbs: ["create", "patch"]
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["watch", "get", "list"]
{{- if .Values.cni.repair.repairPods }}
{{- /*  No privileges needed*/}}
{{- else if .Values.cni.repair.deletePods }}
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["delete"]
{{- else if .Values.cni.repair.labelPods }}
  - apiGroups: [""]

func AnnotateEnrolledPod(client kubernetes.Interface, pod *metav1.ObjectMeta) error {
	_, err := client.CoreV1().
		Pods(pod.Namespace).
		Patch(
			context.Background(),
			pod.Name,
			types.MergePatchType,
			annotationPatch,
			metav1.PatchOptions{},
			// Both "pods" and "pods/status" can mutate the metadata. However, pods/status is lower privilege, so we use that instead.
			"status",
		)
	return err
}

    resourceQuotas:
      enabled: false
      pods: 5000

    # The number of pods that can be unavailable during rolling update (see
    # `updateStrategy.rollingUpdate.maxUnavailable` here:
    # https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
    # May be specified as a number of pods or as a percent of the total number
    # of pods at the start of the update.
    rollingMaxUnavailable: 1

  resources:
  - leases
  verbs:
  - get
  - create
  - update
- apiGroups:
  - ""
  resources:
  - configmaps
  - endpoints
  - events
  - namespaces
  - pods
  - pods/proxy
  - pods/portforward
  - persistentvolumeclaims
  - secrets
  - services
  - serviceaccounts
  - resourcequotas
  verbs:
  - '*'

			args:           strings.Split("clusters invalid", " "),
			expectedString: "unable to retrieve Pod: pods \"invalid\" not found",
			wantException:  true, // "istioctl proxy-config clusters invalid" should fail
		},
		{ // listeners invalid
			args:           strings.Split("listeners invalid", " "),
			expectedString: "unable to retrieve Pod: pods \"invalid\" not found",
			wantException:  true, // "istioctl proxy-config listeners invalid" should fail

  // value represents the integer value of this priority class. This is the actual priority that pods
  // receive when they have the name of this class in their pod spec.
  optional int32 value = 2;

  // globalDefault specifies whether this PriorityClass should be considered as
  // the default priority for pods that do not have any priority class.
  // Only one PriorityClass can be marked as `globalDefault`. However, if more than

      operator: NotIn
      values:
      - canary
  reinvocationPolicy: Never
  rules:
  - apiGroups:
    - ""
    apiVersions:
    - v1
    operations:
    - CREATE
    resources:
    - pods
    scope: '*'
  sideEffects: None
  timeoutSeconds: 10
---
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  labels:
    app: sidecar-injector