},
                  "custom_match": {
                    "name": "ip",
                    "typed_config": {
                      "@type": "type.googleapis.com/xds.type.matcher.v3.IPMatcher",
                      "range_matchers": [
                        {
                          "ranges": [
                            {
                              "address_prefix": "10.111.182.109",

                  },
                  "custom_match": {
                    "name": "ip",
                    "typed_config": {
                      "@type": "type.googleapis.com/xds.type.matcher.v3.IPMatcher",
                      "range_matchers": [
                        {
                          "ranges": [
                            {
                              "address_prefix": "10.104.171.68",

                  },
                  "custom_match": {
                    "name": "ip",
                    "typed_config": {
                      "@type": "type.googleapis.com/xds.type.matcher.v3.IPMatcher",
                      "range_matchers": [
                        {
                          "ranges": [
                            {
                              "address_prefix": "10.111.182.109",

	m.With(resultLabel.Value(resultSuccess)).Increment()
	return nil
}

// MatchesFilter returns true if the pod matches the repair filter criteria
func (c *Controller) matchesFilter(pod *corev1.Pod) bool {
	// Helper function; checks that a container's termination message matches filter
	matchTerminationMessage := func(state *corev1.ContainerStateTerminated) bool {

	n := match.GetMatcherTree().GetInput().GetName()

	var m map[string]*matcher.Matcher_OnMatch
	equality := "="
	switch v := match.GetMatcherTree().GetTreeType().(type) {
	case *matcher.Matcher_MatcherTree_ExactMatchMap:
		m = v.ExactMatchMap.Map
	case *matcher.Matcher_MatcherTree_PrefixMatchMap:
		m = v.PrefixMatchMap.Map
		equality = "^"
	case *matcher.Matcher_MatcherTree_CustomMatch:
		tc := v.CustomMatch.GetTypedConfig()

)

// ServiceFilter is used to pass filter information into service based config writer print functions
type ServiceFilter struct {
	Namespace string
}

// Verify returns true if the passed workload matches the filter fields
func (wf *ServiceFilter) Verify(svc *ZtunnelService) bool {
	if wf.Namespace != "" {
		if !strings.EqualFold(svc.Namespace, wf.Namespace) {
			return false
		}
	}

	return true
}

                "color": "red",
                "value": 80
              }
            ]
          },
          "unit": "ops"
        },
        "overrides": [
          {
            "matcher": {
              "id": "byValue",
              "options": {
                "op": "gte",
                "reducer": "allIsNull",
                "value": 0
              }
            },

}

func extractMatchedSelectorInfo(ls *metav1.LabelSelector, objLabels map[string]string) (matched bool, injLabel string) {
	if ls == nil {
		return true, ""
	}
	selector, err := metav1.LabelSelectorAsSelector(ls)
	if err != nil {
		return false, ""
	}
	matched = selector.Matches(labels.Set(objLabels))
	if !matched {
		return matched, ""
	}
	for _, me := range ls.MatchExpressions {
		switch me.Operator {

  // matches only a single label. You cannot have a wildcard label by itself (e.g. Host == "*").
  // Requests will be matched against the Host field in the following way:
  // 1. If host is precise, the request matches this rule if the http host header is equal to Host.
  // 2. If host is a wildcard, then the request matches this rule if the http host header

  // matches only a single label. You cannot have a wildcard label by itself (e.g. Host == "*").
  // Requests will be matched against the Host field in the following way:
  // 1. If Host is precise, the request matches this rule if the http host header is equal to Host.
  // 2. If Host is a wildcard, then the request matches this rule if the http host header