s.usedPVCSet = createUsedPVCSet(pods)

	return s
}

// createNodeInfoMap obtains a list of pods and pivots that list into a map
// where the keys are node names and the values are the aggregated information
// for that node.
func createNodeInfoMap(pods []*v1.Pod, nodes []*v1.Node) map[string]*framework.NodeInfo {
	nodeNameToInfo := make(map[string]*framework.NodeInfo)

	}
	c.pods = kclient.New[*v1.Pod](cl)
	c.services = kclient.New[*v1.Service](cl)
	c.queue = controllers.NewQueue("pods", controllers.WithReconciler(c.Reconcile))
	c.pods.AddEventHandler(controllers.ObjectHandler(c.queue.AddObject))
	c.services.AddEventHandler(controllers.FromEventHandler(func(e controllers.Event) {
		o := e.Latest()

// of computing priority only. This ensures that when scheduling zero-request pods, such
// pods will not all be scheduled to the node with the smallest in-use request,
// and that when scheduling regular pods, such pods will not see zero-request pods as
// consuming no resources whatsoever. We chose these values to be similar to the
// resources that we give to cluster addon pods (#10653). But they are pretty arbitrary.

	}
	if ev.Verb != "list" {
		t.Errorf("Unexpected verb, expected list, got %s", ev.Verb)
	}
	if ev.RequestURI != "/api/v1/namespaces/default/pods" {
		t.Errorf("Unexpected user, expected /api/v1/namespaces/default/pods, got %s", ev.RequestURI)
	}
}

func TestFailedMultipleAuthnAudit(t *testing.T) {
	sink := &fakeAuditSink{}

    reinvocationPolicy: Never
    rules:
      - apiGroups:
          - ""
        apiVersions:
          - v1
        operations:
          - CREATE
        resources:
          - pods
        scope: '*'
    sideEffects: None
    timeoutSeconds: 10
  - admissionReviewVersions:
      - v1beta1
      - v1
    clientConfig:
      service:
        name: istiod
        namespace: istio-system

      - watch
      - list
  # Used by Calico for policy information.
  - apiGroups: [""]
    resources:
      - pods
      - namespaces
      - serviceaccounts
    verbs:
      - list
      - watch
  # The CNI plugin patches pods/status.
  - apiGroups: [""]
    resources:
      - pods/status
    verbs:
      - patch
  # Calico monitors various CRDs for config.

	podLogsUsage = metrics.NewCounterVec(
		&metrics.CounterOpts{
			Namespace:      namespace,
			Subsystem:      subsystem,
			Name:           "insecure_backend_total",
			Help:           "Total number of requests for pods/logs sliced by usage type: enforce_tls, skip_tls_allowed, skip_tls_denied",
			StabilityLevel: metrics.ALPHA,
		},
		[]string{"usage"},
	)

		}
		if !defaultListSetting(ss.Deployments) {
			st += fmt.Sprintf("/Deployments: %s", strings.Join(ss.Deployments, ","))
		}
		if !defaultListSetting(ss.Pods) {
			st += fmt.Sprintf("/Pods:%s", strings.Join(ss.Pods, ","))
		}
		if !defaultListSetting(ss.Containers) {
			st += fmt.Sprintf("/Containers: %s", strings.Join(ss.Containers, ","))
		}
		if len(ss.Labels) > 0 {

{{- if .Values.cni.resourceQuotas.enabled }}
apiVersion: v1
kind: ResourceQuota
metadata:
  name: {{ template "name" . }}-resource-quota
  namespace: {{ .Release.Namespace }}
spec:
  hard:
    pods: {{ .Values.cni.resourceQuotas.pods | quote }}
  scopeSelector:
    matchExpressions:
    - operator: In
      scopeName: PriorityClass
      values:
      - system-node-critical

func AnnotateEnrolledPod(client kubernetes.Interface, pod *metav1.ObjectMeta) error {
	_, err := client.CoreV1().
		Pods(pod.Namespace).
		Patch(
			context.Background(),
			pod.Name,
			types.MergePatchType,
			annotationPatch,
			metav1.PatchOptions{},
			// Both "pods" and "pods/status" can mutate the metadata. However, pods/status is lower privilege, so we use that instead.
			"status",
		)
	return err
}