c.pods.ShutdownHandlers()
}

func (c *Controller) Reconcile(key types.NamespacedName) error {
	pod := c.pods.Get(key.Name, key.Namespace)
	if pod == nil {
		delete(c.repairedPods, key) // Ensure we do not leak
		// Pod deleted, nothing to do
		return nil
	}
	return c.ReconcilePod(pod)
}

func (c *Controller) ReconcilePod(pod *corev1.Pod) (err error) {
	if !c.matchesFilter(pod) {

  // Required.
  repeated string verbs = 1;

  // `nonResourceURLs` is a set of url prefixes that a user should have access to and may not be empty.
  // For example:
  //   - "/healthz" is legal
  //   - "/hea*" is illegal
  //   - "/hea" is legal but matches nothing
  //   - "/hea/*" also matches nothing
  //   - "/healthz/*" matches all per-component health checks.

  // Required.
  repeated string verbs = 1;

  // `nonResourceURLs` is a set of url prefixes that a user should have access to and may not be empty.
  // For example:
  //   - "/healthz" is legal
  //   - "/hea*" is illegal
  //   - "/hea" is legal but matches nothing
  //   - "/hea/*" also matches nothing
  //   - "/healthz/*" matches all per-component health checks.

      and distribution as defined by Sections 1 through 9 of this document.

      "Licensor" shall mean the copyright owner or entity authorized by
      the copyright owner that is granting the License.

      "Legal Entity" shall mean the union of the acting entity and all
      other entities that control, are controlled by, or are under common
      control with that entity. For the purposes of this definition,

      and distribution as defined by Sections 1 through 9 of this document.

      "Licensor" shall mean the copyright owner or entity authorized by
      the copyright owner that is granting the License.

      "Legal Entity" shall mean the union of the acting entity and all
      other entities that control, are controlled by, or are under common
      control with that entity. For the purposes of this definition,

    # The namespace to treat as the administrative root namespace for Istio configuration.
    # When processing a leaf namespace Istio will search for declarations in that namespace first
    # and if none are found it will search in the root namespace. Any matching declaration found in the root namespace
    # is processed as if it were declared in the leaf namespace.
    rootNamespace: {{ .Values.meshConfig.rootNamespace | default .Values.global.istioNamespace }}

Copyright (C) 2017-2022 Alec Thomas

Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
of the Software, and to permit persons to whom the Software is furnished to do
so, subject to the following conditions:

				secret.Identity, valueOrNA(""), secret.State, false, valueOrNA(""), valueOrNA(""), valueOrNA(""))
		} else {
			for i, ca := range secret.CertChain {
				t := "Intermediate"
				if i == 0 {
					t = "Leaf"
				} else if i == len(secret.CertChain)-1 {
					t = "Root"
				}
				n := new(big.Int)
				n, _ = n.SetString(ca.SerialNumber, 10)
				fmt.Fprintf(w, "%v\t%v\t%v\t%v\t%x\t%v\t%v\n",

func podAndNetns() (*v1.Pod, *fakeNs) {
	devNull, err := os.Open(os.DevNull)
	if err != nil {
		panic(err)
	}
	// we can't close this now, because we need to pass it from the ztunnel server to the client
	// it would leak, but this is a test, so we don't care
	//	defer devNull.Close()

	id := ztunnelTestCounter.Add(1)
	pod := &v1.Pod{
		ObjectMeta: metav1.ObjectMeta{
			Name: fmt.Sprintf("name-%d", id),

	for _, ws := range was {
		if ws.Injected {
			injectedTotal++
		}
		w.AddRow(ws)
	}
	w.Flush()
	if injectedTotal > 1 {
		fmt.Fprintf(writer, "ERROR: multiple webhooks will inject, which can lead to errors")
	}
	return nil
}

type webhookAnalysis struct {
	Name     string
	Revision string
	Injected bool
	Reason   string
}