},
		},
		{
			name: "both default label injection",
			pod:  podTestObject("test1", "test1", "true", ""),
			ns:   nsTestObject("test1", "enabled", ""),
			expectedMessages: []webhookAnalysis{
				{
					Name:     "istio-sidecar-injector",
					Revision: "default",
					Injected: true,
					Reason:   "Namespace label istio-injection=enabled matches, and pod label sidecar.istio.io/inject=true matches",
				},
				{

	registerStringParameter(constants.RepairLabelKey, "cni.istio.io/uninitialized",
		"The key portion of the label which will be set by the race repair if label pods is true")
	registerStringParameter(constants.RepairLabelValue, "true",
		"The value portion of the label which will be set by the race repair if label pods is true")

	injector := getInjector(namespace, hooks)
	if injector != nil {
		return injector.ObjectMeta.GetLabels()[label.IoIstioRev.Name]
	}
	newRev := namespace.ObjectMeta.GetLabels()[label.IoIstioRev.Name]
	oldLabel, ok := namespace.ObjectMeta.GetLabels()[analyzer_util.InjectionLabelName]
	// If there is no istio-injection=disabled and no istio.io/rev, the namespace isn't injected

	whLabels = maps.MergeCopy(whLabels, curLabels)
	whLabels = maps.MergeCopy(whLabels, customLabels)
	if userManaged {
		for label := range whLabels {
			if strings.Contains(label, operatorNamespace) {
				delete(whLabels, label)
			}
		}
	}
	return whLabels
}

// generateMutatingWebhook renders a mutating webhook configuration from the given tagWebhookConfig.

	}

	// We test the cross product namespace and pod labels:
	// 1. revision label (istio.io/rev)
	// 2. inject label true (istio-injection on namespace, sidecar.istio.io/inject on pod)
	// 3. inject label false
	// 4. inject label true and revision label
	// 5. inject label false and revision label
	// 6. no label
	// However, we filter out all the disable cases, leaving us with a reasonable number of cases

  optional int32 replicas = 1;

  // selector is the label query over pods that should match the replicas count. This is same
  // as the label selector but in the string format to avoid introspection
  // by clients. The string will be in the same format as the query-param syntax.
  // More info about label selectors: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
  // +optional

  optional int32 replicas = 1;

  // selector is a label query over pods that should match the replicas count. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
  // +optional
  map<string, string> selector = 2;

  // targetSelector is the label selector for pods that should match the replicas count. This is a serializated

			lkv := strings.Split(l, "=")
			if len(lkv) != 2 {
				panic("label must have format key=value")
			}
			if !hasLabel(obj, lkv[0], lkv[1]) {
				hasAll = false
				break
			}
		}
		if hasAll {
			ret.append(obj)
		}
	}
	return ret
}

// HasLabel reports whether 0 has the given label.
func hasLabel(o *object.K8sObject, label, value string) bool {

      #   values: S1,S2
      #   topologyKey: "kubernetes.io/hostname"
      # This pod anti-affinity rule says that the pod requires not to be scheduled
      # onto a node if that node is already running a pod with label having key
      # "security" and value "S1".
      podAntiAffinityLabelSelector: []
      podAntiAffinityTermLabelSelector: []

      # whether to run the gateway in a privileged container
      runAsRoot: false

      #   values: S1,S2
      #   topologyKey: "kubernetes.io/hostname"
      # This pod anti-affinity rule says that the pod requires not to be scheduled
      # onto a node if that node is already running a pod with label having key
      # "security" and value "S1".
      podAntiAffinityLabelSelector: []
      podAntiAffinityTermLabelSelector: []

      # whether to run the gateway in a privileged container
      runAsRoot: false