// target program. This pinner in turn can be used to extend this property
// to other objects, which debuggers can use to simplify the evaluation of
// expressions involving multiple call injections.
func debugPinnerV1() *Pinner {
	p := new(Pinner)
	p.Pin(unsafe.Pointer(p))
	if debugPinnerKeepUnpin {
		// Make Unpin reachable.
		p.Unpin()
	}
	return p

			in:          "hello-host-network-with-ns.yaml",
			want:        "hello-host-network-with-ns.yaml.injected",
			expectedLog: "Skipping injection because Deployment \"sample/hello-host-network\" has host networking enabled",
		},
		{
			// Verifies ISTIO_KUBE_APP_PROBERS are correctly merged during multiple injections.
			in:   "merge-probers.yaml",
			want: "merge-probers.yaml.injected",
			setFlags: []string{

# Broken config in a yaml config file
#

# Namespace is explicitly enabled
apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio-injection: enabled
  name: default
---
# Namespace doesn't have the injection label, but is labeled for ambient
apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio.io/dataplane-mode: ambient
  name: ambient
---
# Namespace is explicitly disabled, Should not generate warning!

)

// Analyzer checks conditions related to Istio sidecar injection.
type Analyzer struct{}

var _ analysis.Analyzer = &Analyzer{}

// We assume that enablement is via an istio-injection=enabled or istio.io/rev namespace label
// In theory, there can be alternatives using Mutatingwebhookconfiguration, but they're very uncommon
// See https://istio.io/docs/ops/troubleshooting/injection/ for more info.
var (

	"istio.io/istio/pkg/config/schema/gvk"
	"istio.io/istio/pkg/slices"
)

// ImageAnalyzer checks the image of auto-injection configured with the running proxies on pods.
type ImageAnalyzer struct{}

var _ analysis.Analyzer = &ImageAnalyzer{}

// injectionConfigMap is a snippet of the sidecar injection ConfigMap
type injectionConfigMap struct {
	Global global `json:"global"`
}

type global struct {

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
releaseNotes:
  - |

# Namespace 'enabled-namespace' has istio injection enabled, so will be enforced.
apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio-injection: enabled
  name: enabled-namespace
---
# Namespace 'enabled-namespace-2' has istio injection enabled, so will be enforced.
apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio-injection: enabled
  name: enabled-namespace-2
---

apiVersion: release-notes/v2
kind: bug-fix
area: installation
docs:
- 'https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#customizing-injection'
releaseNotes:
- |

apiVersion: release-notes/v2
kind: bug-fix
area: installation
docs:
- 'https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#customizing-injection'
releaseNotes:
- |

# Namespace 'enabled-namespace' has istio injection enabled, so will be enforced.
apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio-injection: enabled
  name: enabled-namespace
---
# Details-v1-pod-old is out of date and should get a warning.
apiVersion: v1
kind: Pod
metadata:
  labels:
    app: details
  name: details-v1-pod-old
  namespace: enabled-namespace
spec:
  containers: