DeprecatedTopology: map[string]string{corev1.LabelHostname: "valid-node-1"},
					},
					{
						Hostname:           ptr.To("hostname-2"),
						DeprecatedTopology: map[string]string{corev1.LabelHostname: "invalid node-2"},
					},
					{
						Hostname:           ptr.To("hostname-3"),
						DeprecatedTopology: map[string]string{corev1.LabelHostname: "valid-node-3"},
					},
					{

			external: v1beta1.Endpoint{
				NodeName: utilpointer.String("node-1"),
				Topology: map[string]string{
					corev1.LabelHostname: "node-2",
				},
			},
			internal: discovery.Endpoint{
				NodeName: utilpointer.String("node-1"),
				DeprecatedTopology: map[string]string{
					corev1.LabelHostname: "node-2",
				},
			},
		},
		{
			desc: "nodeName and topology[hostname] are populated with same values",

				SpreadConstraint(1, v1.LabelHostname, v1.ScheduleAnyway, fooSelector, nil, nil, nil, nil).
				Obj(),
			nodes: []*v1.Node{
				st.MakeNode().Name("node-a").Label("zone", "zone1").Label(v1.LabelHostname, "node-a").Obj(),
				st.MakeNode().Name("node-b").Label("zone", "zone1").Label(v1.LabelHostname, "node-b").Obj(),
				st.MakeNode().Name("node-x").Label("zone", "zone2").Label(v1.LabelHostname, "node-x").Obj(),
			},

			},
			pvs: []*v1.PersistentVolume{
				makePV("pv-a", waitSC.Name).withPhase(v1.VolumeBound).withNodeAffinity(map[string][]string{
					v1.LabelHostname: {"node-a"},
				}).PersistentVolume,
				makePV("pv-b", waitSC.Name).withPhase(v1.VolumeBound).withNodeAffinity(map[string][]string{
					v1.LabelHostname: {"node-a"},
				}).PersistentVolume,
			},
			wantPreFilterResult: &framework.PreFilterResult{
				NodeNames: sets.New("node-a"),

		//}
		for _, v := range podAntiAffinityTerms {
			if v.TopologyKey != v1.LabelHostname {
				return apierrors.NewForbidden(attributes.GetResource().GroupResource(), pod.Name, fmt.Errorf("affinity.PodAntiAffinity.RequiredDuringScheduling has TopologyKey %v but only key %v is allowed", v.TopologyKey, v1.LabelHostname))
			}
		}
	}
	return nil

		// values for topology[hostname] and nodename in v1beta1, without showing
		// duplicate values in v1.
		if node, ok := in.Topology[corev1.LabelHostname]; ok {
			if out.NodeName != nil && node == *out.NodeName {
				delete(out.DeprecatedTopology, corev1.LabelHostname)
			}
		}

		// If zone & hostname were the only field in the map or topology was empty
		// set DeprecatedTopology to nil

	"istio.io/istio/pkg/network"
)

// copied from https://github.com/kubernetes/api/blob/master/core/v1/well_known_labels.go
// It is to remove dependency on k8s.io/api/core/v1
const (
	LabelHostname = "kubernetes.io/hostname"

	LabelTopologyZone    = "topology.kubernetes.io/zone"
	LabelTopologySubzone = "topology.istio.io/subzone"
	LabelTopologyRegion  = "topology.kubernetes.io/region"
)

									{
										Key:      "security",
										Operator: metav1.LabelSelectorOpIn,
										Values:   []string{"S2"},
									},
								},
							},
							TopologyKey: v1.LabelHostname,
						},
					},
				},
			},
			errorExpected: false,
		},
		// valid topologyKey in requiredDuringSchedulingIgnoredDuringExecution then admission success.
		{
			affinity: &api.Affinity{

								{
									MatchExpressions: []v1.NodeSelectorRequirement{
										{
											Key:      v1.LabelHostname,
											Operator: v1.NodeSelectorOpIn,
											Values: []string{
												"node1",
												"node2",
											},
										},
										{
											Key:      v1.LabelHostname,
											Operator: v1.NodeSelectorOpIn,
											Values: []string{
												"node2",

*/

// Package antiaffinity provides the LimitPodHardAntiAffinityTopology
// admission controller. It rejects any pod that specifies "hard"
// (RequiredDuringScheduling) anti-affinity with a TopologyKey other
// than v1.LabelHostname.  Because anti-affinity is symmetric, without
// this admission controller, a user could maliciously or accidentally
// specify that their pod (once it has scheduled) should block other