// Find the Prometheus pod and service, and start forwarding a local port.
		fetchFn := testKube.NewSinglePodFetch(cls, cfg.TelemetryNamespace, fmt.Sprintf("app.kubernetes.io/name=%s", appName))
		pods, err := testKube.WaitUntilPodsAreReady(fetchFn)
		if err != nil {
			return nil, err
		}
		pod := pods[0]

	// value represents the integer value of this priority class. This is the actual priority that pods
	// receive when they have the name of this class in their pod spec.
	Value int32 `json:"value" protobuf:"bytes,2,opt,name=value"`

	// globalDefault specifies whether this PriorityClass should be considered as
	// the default priority for pods that do not have any priority class.

}

// NewMock creates a helper to build Collections of static inputs for use with testing.
// Example usage:
//
//	mock := krttest.NewMock(t, []any{serviceFoo, podBar, namespaceBaz})
//	pods := krttest.GetMockCollection[Pod](mock) // makes a collection of all Pod types from inputs
func NewMock(t test.Failer, inputs []any) *MockCollection {
	t.Helper()
	mc := &MockCollection{t: t, inputs: inputs}
	t.Cleanup(func() {
		t.Helper()

apiVersion: v1
kind: Pod
metadata:
  name: selector-test-pod
  labels:
    name: selector-test-pod
    unique-label: bingbang
spec:
  containers:
  - name: kubernetes-pause

apiVersion: v1
kind: Pod
metadata:
  name: selector-test-pod-dont-apply
  labels:
    name: selector-test-pod-dont-apply
    unique-label: biz
spec:
  containers:
  - name: kubernetes-pause

{
  "apiVersion": "v1",
  "kind": "Pod",
  "metadata": {
    "name": "pod-with-precision"
  },
  "spec": {
    "activeDeadlineSeconds": 2147483647,
    "containers": [
      {
        "name": "kubernetes-pause",
        "image": "registry.k8s.io/pause:3.10"
      }
    ],
    "restartPolicy": "Never",
    "securityContext": {
      "supplementalGroups": [
        0,
        1000030003,
        2147483647
      ]

		removed = subs.Difference(have).Difference(haveAliases).Merge(removed)
	}

	if !w.Wildcard {
		// For on-demand, we may have requested a VIP but gotten Pod IPs back. We need to update
		// the internal book-keeping to subscribe to the Pods, so that we push updates to those Pods.
		w.ResourceNames = subs.Merge(have).UnsortedList()
	} else {
		// For wildcard, we record all resources that have been pushed and not removed

    operator.istio.io/component: "Cni"
rules:
- apiGroups: [""]
  {{- /* pods/status is less privileged than the full pod, and either can label. So use the lower pods/status */}}
  resources: ["pods/status"]
  verbs: ["patch", "update"]

func IsZtunnelPod(systemNs string, pod *corev1.Pod) bool {
	return pod.Namespace == systemNs && pod.GetLabels()["app"] == "ztunnel"
}

func AnnotateEnrolledPod(client kubernetes.Interface, pod *metav1.ObjectMeta) error {
	_, err := client.CoreV1().
		Pods(pod.Namespace).
		Patch(
			context.Background(),
			pod.Name,
			types.MergePatchType,
			annotationPatch,
			metav1.PatchOptions{},

				// Make sure CNI pod is using image with applied version.
				retry.UntilSuccessOrFail(t, func() error {
					pods, err := podFetchFn()
					if err != nil {
						return fmt.Errorf("failed to get CNI pods %v", err)
					}
					if len(pods) == 0 {
						return fmt.Errorf("cannot find any CNI pods")
					}
					for _, p := range pods {
						if !strings.Contains(p.Spec.Containers[0].Image, v) {