args:           strings.Split("clusters invalid", " "),
			expectedString: "unable to retrieve Pod: pods \"invalid\" not found",
			wantException:  true, // "istioctl proxy-config clusters invalid" should fail
		},
		{ // listeners invalid
			args:           strings.Split("listeners invalid", " "),
			expectedString: "unable to retrieve Pod: pods \"invalid\" not found",
			wantException:  true, // "istioctl proxy-config listeners invalid" should fail

      operator: NotIn
      values:
      - "false"
  reinvocationPolicy: Never
  rules:
  - apiGroups:
    - ""
    apiVersions:
    - v1
    operations:
    - CREATE
    resources:
    - pods
    scope: '*'
  sideEffects: None
  timeoutSeconds: 10
- admissionReviewVersions:
  - v1beta1
  - v1
  clientConfig:
    service:
      name: istiod-test-dev2
      namespace: istio-system

  resources:
  - leases
  verbs:
  - get
  - create
  - update
- apiGroups:
  - ""
  resources:
  - configmaps
  - endpoints
  - events
  - namespaces
  - pods
  - pods/proxy
  - pods/portforward
  - persistentvolumeclaims
  - secrets
  - services
  - serviceaccounts
  - resourcequotas
  verbs:
  - '*'

apiVersion: release-notes/v2
kind: feature
area: traffic-management
issue:
  - 50736
releaseNotes:
- |
  **Added** Allow pods to be opted out of ambient capture using the `istio.io/dataplane-mode=none` label.

			if err != nil {
				t.Fatal(err)
			}
			if len(deps.Items) == 0 {
				t.Skip("no deployments with label app=istiod")
			}
			pods := primary.Kube().CoreV1().Pods(ns)
			podMeta := deps.Items[0].Spec.Template.ObjectMeta
			podMeta.Name = pod
			template := deps.Items[0].Spec.Template.Spec
			for _, container := range template.Containers {

			return err
		}
	}

	// Collect pods from test run. For the majority of cases we would
	// expect to see a single pod here, but allow for multiple pods in
	// case the test harness is doing extra work to collect data files
	// from builds that it kicks off as part of the testing.
	podlist, err := pods.CollectPods([]string{dir}, false)
	if err != nil {

			}
		}

		return true
	})
	for ns, pods := range namespaceMismatchedPods {
		sort.Strings(pods)
		c.Report(gvk.Namespace, msg.NewPodsIstioProxyImageMismatchInNamespace(namespaceResources[ns], pods))
	}
}

// GetIstioProxyImage retrieves the proxy image name defined in the sidecar injector
// configuration.

        return result == "" ? [] : result.split("\\n")
    }

    // Only supported on *nix platforms
    String[] getProcessInfo(String[] pids) {
        if (pids == null || pids.size() == 0) {
            throw new RuntimeException("Unable to get process info because provided pids are null or empty!")
        }
        if (!(OperatingSystem.current().unix)) {

		return server, storage
	}
	server, etcdStorage := newEtcdTestStorage(t, "")
	defer server.Terminate(t)

		// ensure that that is applied before the call to ConnectEx begins
		// so that we don't return spurious connections.
		defer fd.pfd.SetWriteDeadline(noDeadline)

		if ctx.Err() != nil {
			fd.pfd.SetWriteDeadline(aLongTimeAgo)
		} else {
			if deadline, ok := ctx.Deadline(); ok && !deadline.IsZero() {
				fd.pfd.SetWriteDeadline(deadline)
			}

			done := make(chan struct{})
			stop := context.AfterFunc(ctx, func() {