}
		if isDeactivated {
			return "The injection webhook is deactivated, and will never match labels."
		}
		return fmt.Sprintf("No matching namespace labels (%s) "+
			"or pod labels (%s)", strings.Join(nsMatchedLabels, ", "), strings.Join(podMatchedLabels, ", "))
	}
	return noMatchingReason(whs), false
}

	}
	os.WriteFile(filepath.Join(cfg.MountedCNINetDir, cfg.KubeconfigFilename), []byte(expectedKC.Full), 0o644)

	err = checkExistingKubeConfigFile(cfg, expectedKC)
	if err != nil {
		t.Fatalf("expected no error, matching kubeconfig present, got %+v", err)
	}

			args: strings.Split("service productpage", " "),
			expectedOutput: `Service: productpage
DestinationRule: productpage for "productpage"
   WARNING POD DOES NOT MATCH ANY SUBSETS.  (Non matching subsets v1)
   Matching subsets: 
      (Non-matching subsets v1)
   No Traffic Policy
VirtualService: bookinfo
   Route to host "productpage" with weight 30%
   Route to host "productpage2" with weight 20%

				{
					Name:     "istio-sidecar-injector",
					Revision: "default",
					Reason: "No matching namespace labels (istio.io/rev=default, istio-injection=enabled) " +
						"or pod labels (istio.io/rev=default, sidecar.istio.io/inject=true)",
				},
				{
					Name:     "istio-sidecar-injector-1-16",
					Revision: "1-16",
					Reason:   "No matching namespace labels (istio.io/rev=1-16) or pod labels (istio.io/rev=1-16)",
				},
				{

		return r
	}()
	codecs       = serializer.NewCodecFactory(runtimeScheme)
	deserializer = codecs.UniversalDeserializer()
)

// GetFirstPod returns a pod matching the namespace and label selector
// and the number of all pods that match the label selector.
// This is forked from  polymorphichelpers.GetFirstPod to not watch and instead return an error if no pods are found

			fmt.Fprintf(writer, "%sWARNING POD DOES NOT MATCH ANY SUBSETS.  (Non matching subsets %s)\n",
				printSpaces(initPrintNum+printLevel1), strings.Join(nonmatchingSubsets, ","))
		}
		fmt.Fprintf(writer, "%sMatching subsets: %s\n",
			printSpaces(initPrintNum+printLevel1), strings.Join(matchingSubsets, ","))
		if len(nonmatchingSubsets) > 0 {
			fmt.Fprintf(writer, "%s(Non-matching subsets %s)\n",

func startInstallServer(ctx context.Context, serverConfig *config.Config, t *testing.T) {
	readyFlag := &atomic.Value{}
	installer := install.NewInstaller(&serverConfig.InstallConfig, readyFlag)

	t.Logf("CNI installer created, watching...")
	// installer.Run() will block indefinitely, and attempt to permanently "keep"
	// the CNI binary installed.
	if err := installer.Run(ctx); err != nil {

			return nil, err
		}
		// ENABLE_EXTERNAL_NAME_ALIAS
		if err := checkExternalNameAlias(cli, &messages); err != nil {
			return nil, err
		}
		// PERSIST_OLDEST_FIRST_HEURISTIC_FOR_VIRTUAL_SERVICE_HOST_MATCHING
		if err := checkVirtualServiceHostMatching(cli, &messages); err != nil {
			return nil, err
		}
	}
	if minor <= 21 {
		if err := checkPassthroughTargetPorts(cli, &messages); err != nil {
			return nil, err

		}
	}
	return w.Flush()
}

func getInjector(namespace *corev1.Namespace, hooks []admitv1.MutatingWebhookConfiguration) *admitv1.MutatingWebhookConfiguration {
	// find matching hook
	for _, hook := range hooks {
		for _, webhook := range hook.Webhooks {
			nsSelector, err := metav1.LabelSelectorAsSelector(webhook.NamespaceSelector)
			if err != nil {
				continue
			}

						if want != found {
							t.Fatalf("expected webhook to go to service %q, found %q", want, found)
						}
						return
					}
					// Otherwise, look through our assertions for a matching one, and check that
					for _, w := range tt.checks {
						if w.namespaceLabel.String() == s.namespace.String() && w.objectLabel.String() == s.pod.String() {
							if found != w.match {
								if found != "" {