m.With(resultLabel.Value(resultSuccess)).Increment()
	return nil
}

// MatchesFilter returns true if the pod matches the repair filter criteria
func (c *Controller) matchesFilter(pod *corev1.Pod) bool {
	// Helper function; checks that a container's termination message matches filter
	matchTerminationMessage := func(state *corev1.ContainerStateTerminated) bool {

Xiaopeng Han <******@****.***> 1709887099 +0800

The Istio CNI Node Agent is responsible for several things

- Install an Istio CNI plugin binary on each node's filesystem, updating that node's CNI config in e.g (`/etc/cni/net.d`), and watching the config and binary paths to reinstall if things are modified.

  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 1;

  // An object that describes the pod that will be created.
  // The DaemonSet will create exactly one copy of this pod on every node
  // that matches the template's node selector (or on every node if no node
  // selector is specified).
  // The only allowed template.spec.restartPolicy value is "Always".

  // +optional
  optional string path = 1;

  // pathType determines the interpretation of the path matching. PathType can
  // be one of the following values:
  // * Exact: Matches the URL path exactly.
  // * Prefix: Matches based on a URL path prefix split by '/'. Matching is
  //   done on a path element by element basis. A path element refers is the
  //   list of labels in the path split by the '/' separator. A request is a

  // +optional
  optional string path = 1;

  // pathType determines the interpretation of the path matching. PathType can
  // be one of the following values:
  // * Exact: Matches the URL path exactly.
  // * Prefix: Matches based on a URL path prefix split by '/'. Matching is
  //   done on a path element by element basis. A path element refers is the
  //   list of labels in the path split by the '/' separator. A request is a

}

// ResourcePolicyRule is a predicate that matches some resource
// requests, testing the request's verb and the target resource. A
// ResourcePolicyRule matches a resource request if and only if: (a)
// at least one member of verbs matches the request, (b) at least one
// member of apiGroups matches the request, (c) at least one member of
// resources matches the request, and (d) either (d1) the request does

}

// ResourcePolicyRule is a predicate that matches some resource
// requests, testing the request's verb and the target resource. A
// ResourcePolicyRule matches a resource request if and only if: (a)
// at least one member of verbs matches the request, (b) at least one
// member of apiGroups matches the request, (c) at least one member of
// resources matches the request, and (d) either (d1) the request does

  // Required
  optional string namespace = 1;

  // `name` is the name of the service.
  // Required
  optional string name = 2;

  // `path` is an optional URL path which will be sent in any request to
  // this service.
  // +optional
  optional string path = 3;

  // If specified, the port on the service that hosting webhook.
  // Default to 443 for backward compatibility.

		port := retrieveListenerPort(l)
		if filter.Verbose {

			matches := retrieveListenerMatches(l)
			sort.Slice(matches, func(i, j int) bool {
				return matches[i].destination > matches[j].destination
			})
			for _, match := range matches {
				if includeConfigType {
					name := fmt.Sprintf("listener/%s", l.Name)