}

	return revisions, nil
}

func Webhooks(ctx context.Context, client kube.CLIClient) ([]admitv1.MutatingWebhookConfiguration, error) {
	hooks, err := client.Kube().AdmissionregistrationV1().MutatingWebhookConfigurations().List(ctx, metav1.ListOptions{})
	if err != nil {
		return []admitv1.MutatingWebhookConfiguration{}, err
	}
	return hooks.Items, nil
}

func renderWithDefault(s, def string) string {
	if s != "" {

# Simulate the case where the default installation failed, and the user has to reinstall the components.
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  labels:
    app: sidecar-injector
  name: w-istio-sidecar-injector-istio-system

webhooks:
- admissionReviewVersions:
  - v1beta1
  - v1
  clientConfig:
    service:
      name: istiod
      namespace: istio-system
      path: /inject

apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: "cloud-pvl-admission.k8s.io"
  labels:
    addonmanager.kubernetes.io/mode: Reconcile
    k8s-app: cloud-pvl-admission
webhooks:
- name: "cloud-pvl-admission.k8s.io"
  rules:
  - apiGroups:   [""]
    apiVersions: ["v1"]
    operations:  ["CREATE"]
    resources:   ["persistentvolumes"]
    scope:       "*"
  clientConfig:

	case *istioioapimeshv1alpha1.MeshConfig:
		return gvk.MeshConfig, true
	case *istioioapimeshv1alpha1.MeshNetworks:
		return gvk.MeshNetworks, true
	case *k8sioapiadmissionregistrationv1.MutatingWebhookConfiguration:
		return gvk.MutatingWebhookConfiguration, true
	case *k8sioapicorev1.Namespace:
		return gvk.Namespace, true
	case *k8sioapicorev1.Node:
		return gvk.Node, true
	case *istioioapisecurityv1beta1.PeerAuthentication:

// +groupName=admissionregistration.k8s.io

// Package v1 is the v1 version of the API.
// AdmissionConfiguration and AdmissionPluginConfiguration are legacy static admission plugin configuration
// MutatingWebhookConfiguration and ValidatingWebhookConfiguration are for the
// new dynamic admission controller configuration.

// Package admissionregistration is the internal version of the API.
// AdmissionConfiguration and AdmissionPluginConfiguration are legacy static admission plugin configuration
// ValidatingWebhookConfiguration, and MutatingWebhookConfiguration are for the
// new dynamic admission controller configuration.

  - v1beta1
  - v1
  clientConfig:
    url: https://test.com:15017/validate
  failurePolicy: Ignore
  name: validation.istio.io
  
---
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: istio-sidecar-injector-custom-ns
webhooks:
- admissionReviewVersions:
  - v1beta1
  - v1
  clientConfig:
    url:
  failurePolicy: Fail

	track.WaitOrdered("revision,tag-foo")
	assert.Equal(t, tw.GetMyTags(), sets.New("revision", "tag-foo"))
}

func makeTag(revision string, tg string) *admissionregistrationv1.MutatingWebhookConfiguration {
	return &admissionregistrationv1.MutatingWebhookConfiguration{
		TypeMeta: metav1.TypeMeta{},
		ObjectMeta: metav1.ObjectMeta{
			Name: tg,
			Labels: map[string]string{
				label.IoIstioRev.Name: revision,
				"istio.io/tag":        tg,

// +groupName=admissionregistration.k8s.io

// Package v1beta1 is the v1beta1 version of the API.
// AdmissionConfiguration and AdmissionPluginConfiguration are legacy static admission plugin configuration
// MutatingWebhookConfiguration and ValidatingWebhookConfiguration are for the
// new dynamic admission controller configuration.

type DefaultHandler func(string)

type defaultWatcher struct {
	revision        string
	defaultRevision string
	handlers        []DefaultHandler

	queue    controllers.Queue
	webhooks kclient.Client[*admitv1.MutatingWebhookConfiguration]
	mu       sync.RWMutex
}

func NewDefaultWatcher(client kube.Client, revision string) DefaultWatcher {
	p := &defaultWatcher{
		revision: revision,
		mu:       sync.RWMutex{},
	}