// RuntimeClass. Pods using this RuntimeClass can only be scheduled to a
	// node matched by this selector. The RuntimeClass nodeSelector is merged
	// with a pod's existing nodeSelector. Any conflicts will cause the pod to
	// be rejected in admission.
	// +optional
	NodeSelector map[string]string

	// tolerations are appended (excluding duplicates) to pods running with this

				Deployments: []string{"d1", "d2"},
				Pods:        []string{"p1", "p2"},
				Containers:  []string{"c1", "c2"},
				Labels: map[string]string{
					"l1": "lv1",
					"l2": "lv2",
				},
				Annotations: map[string]string{
					"a1": "av1",
					"a2": "av2",
				},
			},
			{
				Namespaces:  []string{"ns4", "ns5"},
				Deployments: []string{"d4", "d5"},
				Pods:        []string{"p4", "p5"},

            - "false"
    reinvocationPolicy: Never
    rules:
      - apiGroups:
          - ""
        apiVersions:
          - v1
        operations:
          - CREATE
        resources:
          - pods
        scope: '*'
    sideEffects: None
    timeoutSeconds: 10
  - admissionReviewVersions:
      - v1beta1
      - v1
    clientConfig:
      service:
        name: istiod-1-16

      operator: NotIn
      values:
      - canary
  reinvocationPolicy: Never
  rules:
  - apiGroups:
    - ""
    apiVersions:
    - v1
    operations:
    - CREATE
    resources:
    - pods
    scope: '*'
  sideEffects: None
  timeoutSeconds: 10
---
# same webhook but with different name, will result in a duplicate
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration

// PodGCControllerConfiguration contains elements describing PodGCController.
type PodGCControllerConfiguration struct {
	// terminatedPodGCThreshold is the number of terminated pods that can exist
	// before the terminated pod garbage collector starts deleting terminated pods.
	// If <= 0, the terminated pod garbage collector is disabled.
	TerminatedPodGCThreshold int32

	return nil
}

// ListKubeContainers lists running k8s CRI pods
func (runtime *CRIRuntime) ListKubeContainers() ([]string, error) {
	ctx, cancel := defaultContext()
	defer cancel()

	sandboxes, err := runtime.impl.ListPodSandbox(ctx, runtime.runtimeService, nil)
	if err != nil {
		return nil, errors.Wrap(err, "failed to list pod sandboxes")
	}

	pods := []string{}
	for _, sandbox := range sandboxes {

	"value":            "value represents the integer value of this priority class. This is the actual priority that pods receive when they have the name of this class in their pod spec.",

	"tolerations":  "tolerations are appended (excluding duplicates) to pods running with this RuntimeClass during admission, effectively unioning the set of nodes tolerated by...

	if err := retry.UntilSuccess(func() error {
		pods, err := cluster.Kube().CoreV1().Pods(i.cfg.SystemNamespace).List(context.TODO(), metav1.ListOptions{
			LabelSelector: eastWestIngressIstioLabel,
		})
		if err != nil {
			return err
		}
		for _, p := range pods.Items {
			if p.Status.Phase == corev1.PodRunning {
				return nil
			}
		}
		return fmt.Errorf("no ready pods for " + eastWestIngressIstioLabel)

		})
	}
}

func testComparePods(actual, cached, queued, missing, redundant []string, t *testing.T) {
	compare := CacheComparer{}
	pods := []*v1.Pod{}
	for _, uid := range actual {
		pod := &v1.Pod{}
		pod.UID = types.UID(uid)
		pods = append(pods, pod)
	}

	queuedPods := []*v1.Pod{}
	for _, uid := range queued {
		pod := &v1.Pod{}
		pod.UID = types.UID(uid)