pod, ns := buildFakePodAndNSForClient()

	pod.Spec.Containers[0].Name = "mockContainer"
	pod.Spec.Containers[1].Name = "istio-proxy"
	pod.ObjectMeta.Annotations[injectAnnotationKey] = "false"

	testDoAddRun(t, buildMockConf(true, ""), testNSName, pod, ns)
}

func TestCmdAddTwoContainersWithLabel(t *testing.T) {
	pod, ns := buildFakePodAndNSForClient()
	pod.Spec.Containers[0].Name = "mockContainer"

	}
	if err := json.Unmarshal(uglyJSON, &decoded); err != nil {
		return []string{}, err
	}
	if d, ok := decoded.(map[string]any); ok {
		if v, ok := d["spec"]; ok {
			// Fall back to showing the entire spec.
			// (When --config-path is used there will be no spec to remove)
			decoded = v
		}
	}
	setflags, err := walk("", "", decoded)
	if err != nil {
		return []string{}, err
	}
	sort.Strings(setflags)

		return err
	}
	// fill empty structs
	if wg.Spec.Metadata == nil {
		wg.Spec.Metadata = &networkingv1alpha3.WorkloadGroup_ObjectMeta{}
	}
	if wg.Spec.Template == nil {
		wg.Spec.Template = &networkingv1alpha3.WorkloadEntry{}
	}
	// default service account for an empty field is "default"
	if wg.Spec.Template.ServiceAccount == "" {
		wg.Spec.Template.ServiceAccount = "default"
	}
	return nil
}

	NodeName = "testnode"
	ctx, cancel := context.WithCancel(context.Background())
	defer cancel()

	pod := &corev1.Pod{
		ObjectMeta: metav1.ObjectMeta{
			Name:      "test",
			Namespace: "test",
		},
		Spec: corev1.PodSpec{
			NodeName: NodeName,
		},
		Status: corev1.PodStatus{
			PodIP: "11.1.1.12",
		},
	}
	ns := &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: "test"}}

	defaultYAML = `apiVersion: networking.istio.io/v1alpha3
kind: WorkloadGroup
metadata:
  name: foo
  namespace: bar
spec:
  metadata: {}
  template:
    serviceAccount: default
`

	customYAML = `apiVersion: networking.istio.io/v1alpha3
kind: WorkloadGroup
metadata:
  name: foo
  namespace: bar
spec:
  metadata:
    annotations:
      annotation: foobar
    labels:
      app: foo
      bar: baz

		rs, err := parseRequestRangeSpec(testCase.spec)
		if err != nil {
			if !testCase.errExpected || err == nil && testCase.errExpected {
				t.Errorf("unexpected err: %v", err)
			}
			continue
		}
		h, err := rs.ToHeader()
		if err != nil && !testCase.errExpected || err == nil && testCase.errExpected {
			t.Errorf("expected error with invalid range: %v", err)
		}
		if h != testCase.spec {

		podLabels := mustGetLabels(t, deployment, "spec.template.metadata.labels")
		// Check all selectors align
		mustSelect(t, mustGetLabels(t, pdb, "spec.selector.matchLabels"), podLabels)
		mustSelect(t, mustGetLabels(t, service, "spec.selector"), podLabels)
		mustSelect(t, mustGetLabels(t, deployment, "spec.selector.matchLabels"), podLabels)
		if hpaName := mustGetPath(t, hpa, "spec.scaleTargetRef.name"); cname != hpaName {

		sniImpacted = sniImpacted || checkSNI(dr.Spec.GetTrafficPolicy().GetTls())
		for _, pl := range dr.Spec.GetTrafficPolicy().GetPortLevelSettings() {
			verificationImpacted = verificationImpacted || checkVerify(pl.GetTls())
			sniImpacted = sniImpacted || checkSNI(pl.GetTls())
		}
		for _, ss := range dr.Spec.Subsets {

	switch t := object.(type) {
	case *gatewayapi.Gateway:
		if !gateway.IsManaged(&t.Spec) {
			return "", nil, fmt.Errorf("gateway is not a managed gateway")
		}
		namespace = t.Namespace
		selector, err = labels.Parse(constants.GatewayNameLabel + "=" + t.Name)
	case *gatewayapibeta.Gateway:
		if !gateway.IsManaged(&t.Spec) {
			return "", nil, fmt.Errorf("gateway is not a managed gateway")
		}
		namespace = t.Namespace

			}
		})
	}
}

func attachPod(ns string) *corev1.Pod {
	return &corev1.Pod{
		ObjectMeta: metav1.ObjectMeta{Name: "foo-abc", Namespace: ns, ResourceVersion: "10"},
		Spec: corev1.PodSpec{
			RestartPolicy: corev1.RestartPolicyAlways,
			DNSPolicy:     corev1.DNSClusterFirst,
			Containers: []corev1.Container{
				{
					Name: "bar",
				},
			},