existingPod, err := p.podsGetter.Pods(a.GetNamespace()).Get(a.GetName())
		if apierrors.IsNotFound(err) {
			return err
		}
		if err != nil {
			return admission.NewForbidden(a, err)
		}
		// only allow a node to delete a pod bound to itself
		if existingPod.Spec.NodeName != nodeName {
			return admission.NewForbidden(a, fmt.Errorf("node %q can only delete pods with spec.nodeName set to itself", nodeName))
		}

		podMetrics      = resource("podmetrics", "default", "metrics.k8s.io")
		nodeMetrics     = resource("nodemetrics", "", "metrics.k8s.io")
		pods            = resource("pods", "default")
		podStatus       = resource("pods", "default", "", "status")
		secrets         = resource("secrets", "default")
		tokenReviews    = resource("tokenreviews", "", "authentication.k8s.io")

	// beta: v1.29
	//
	// Allow users to specify recreating pods of a job only when
	// pods have fully terminated.
	JobPodReplacementPolicy featuregate.Feature = "JobPodReplacementPolicy"

	// owner: @tenzen-y
	// kep: https://kep.k8s.io/3998
	// alpha: v1.30
	//
	// Allow users to specify when a Job can be declared as succeeded
	// based on the set of succeeded pods.
	JobSuccessPolicy featuregate.Feature = "JobSuccessPolicy"

	Resource string
	// Subresource is the name of the subresource being requested.  This is a different resource, scoped to the parent resource, but it may have a different kind.
	// For instance, /pods has the resource "pods" and the kind "Pod", while /pods/foo/status has the resource "pods", the sub resource "status", and the kind "Pod"

// ActivePodsFunc is a function that returns a list of pods to reconcile.
type ActivePodsFunc func() []*v1.Pod

// ManagerImpl is the structure in charge of managing Device Plugins.
type ManagerImpl struct {
	checkpointdir string

	endpoints map[string]endpointInfo // Key is ResourceName
	mutex     sync.Mutex

	server plugin.Server

	// activePods is a method for listing active pods on the node

	pod := newPod(namespace)
	err = handler.Admit(context.TODO(), admission.NewAttributesRecord(&pod, nil, v1.SchemeGroupVersion.WithKind("Pod").GroupKind().WithVersion("version"), pod.Namespace, pod.Name, v1.Resource("pods").WithVersion("version"), "", admission.Create, &metav1.CreateOptions{}, false, nil), nil)
	if err == nil {
		actions := ""
		for _, action := range mockClient.Actions() {

```go
Endpoints := krt.NewManyCollection[Endpoint](func(ctx krt.HandlerContext, svc *v1.Service) (res []Endpoint) {
    for _, c := range krt.Fetch(ctx, Pods, krt.FilterLabel(svc.Spec.Selector)) {
      res = append(res, Endpoint{Service: svc.Name, Pod: pod.Name, IP: pod.status.PodIP})
    }
    return res
}) // Results in a Collection[Endpoint]
```

			server, _ := New(c.ca, time.Duration(1), c.authenticators, multiClusterController)

			var pods []runtime.Object
			for _, p := range c.pods {
				pods = append(pods, toPod(p, strings.HasPrefix(p.name, "ztunnel")))
			}
			client := kube.NewFakeClient(pods...)
			stop := test.NewStop(t)
			multiClusterController.Add("fake", client, stop)
			client.RunAndWait(stop)

// in future we may allow also inline volumes in pods.
// Exactly one member can be set.
message VolumeAttachmentSource {
  // persistentVolumeName represents the name of the persistent volume to attach.
  // +optional
  optional string persistentVolumeName = 1;

  // inlineVolumeSpec contains all the information necessary to attach
  // a persistent volume defined by a pod's inline VolumeSource. This field

// in future we may allow also inline volumes in pods.
// Exactly one member can be set.
message VolumeAttachmentSource {
  // persistentVolumeName represents the name of the persistent volume to attach.
  // +optional
  optional string persistentVolumeName = 1;

  // inlineVolumeSpec contains all the information necessary to attach
  // a persistent volume defined by a pod's inline VolumeSource. This field