// SetPods mocks base method.
func (m *MockManager) SetPods(pods []*v1.Pod) {
	m.ctrl.T.Helper()
	m.ctrl.Call(m, "SetPods", pods)
}

// SetPods indicates an expected call of SetPods.
func (mr *MockManagerMockRecorder) SetPods(pods any) *gomock.Call {
	mr.mock.ctrl.T.Helper()
	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetPods", reflect.TypeOf((*MockManager)(nil).SetPods), pods)
}

// TranslatePodUID mocks base method.

	// We found an issue(https://github.com/kubernetes/kubernetes/issues/110175) in which Pods can be stuck in the unschedulable pod pool for 5 min, and using this flag is the only workaround for this issue.

	ForceActivate = "ForceActivate"
	// PodUpdate is the event when a pod is updated
	PodUpdate = "PodUpdate"
)

var (
	// AssignedPodAdd is the event when a pod is added that causes pods with matching affinity terms
	// to be more schedulable.
	AssignedPodAdd = framework.ClusterEvent{Resource: framework.Pod, ActionType: framework.Add, Label: "AssignedPodAdd"}

	}
	informerFactory.Start(wait.NeverStop)

	pod := newPod(namespace)
	err = handler.Validate(context.TODO(), admission.NewAttributesRecord(&pod, nil, api.Kind("Pod").WithVersion("version"), pod.Namespace, pod.Name, api.Resource("pods").WithVersion("version"), "", admission.Create, &metav1.CreateOptions{}, false, nil), nil)
	if err != nil {
		t.Errorf("unexpected error returned from admission handler")
	}
}

	ResolvConfDefault = "/etc/resolv.conf"
)

// User visible keys for managing node allocatable enforcement on the node.
const (
	NodeAllocatableEnforcementKey = "pods"
	SystemReservedEnforcementKey  = "system-reserved"
	KubeReservedEnforcementKey    = "kube-reserved"
	NodeAllocatableNoneKey        = "none"
)

// SwapBehavior types
const (
	LimitedSwap = "LimitedSwap"

metadata:
  labels:
    kubernetes.io/bootstrapping: rbac-defaults
    addonmanager.kubernetes.io/mode: Reconcile
  name: system:coredns
rules:
- apiGroups:
  - ""
  resources:
  - endpoints
  - services
  - pods
  - namespaces
  verbs:
  - list
  - watch
- apiGroups:
  - discovery.k8s.io
  resources:
  - endpointslices
  verbs:
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1

  - metrics.k8s.io
  resources:
  - pods
  - nodes
  verbs:
  - get
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    k8s-app: metrics-server
  name: system:metrics-server
rules:
- apiGroups:
  - ""
  resources:
  - nodes/metrics
  verbs:
  - get
- apiGroups:
  - ""
  resources:
  - pods
  - nodes
  verbs:
  - get

			StabilityLevel: compbasemetrics.ALPHA,
		},
		[]string{"access_mode"},
	)
	seLinuxPodContextMismatchWarnings = compbasemetrics.NewGaugeVec(
		&compbasemetrics.GaugeOpts{

		ourNs:       ns,
	}
	nt.setup(stop)
	return nt
}

func (n *NodeUntainter) setup(stop <-chan struct{}) {
	nodes := krt.WrapClient[*v1.Node](n.nodesClient)
	pods := krt.WrapClient[*v1.Pod](n.podsClient)

	readyCniPods := krt.NewCollection(pods, func(ctx krt.HandlerContext, p *v1.Pod) *v1.Pod {
		log.Debugf("cniPods event: %s", p.Name)
		if p.Namespace != n.ourNs {
			return nil
		}

    resources: ["*"]

  # Needed because status reporter sets the config map owner reference to the istiod pod
  - apiGroups: [""]
    verbs: ["update"]
    resources: ["pods/finalizers"]
{{- end }}
  - apiGroups: ["networking.istio.io"]
    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
    resources: [ "workloadentries" ]
  - apiGroups: ["networking.istio.io"]