Patch(
			context.Background(),
			pod.Name,
			types.MergePatchType,
			annotationPatch,
			metav1.PatchOptions{},
			// Both "pods" and "pods/status" can mutate the metadata. However, pods/status is lower privilege, so we use that instead.
			"status",
		)
	return err
}

func AnnotateUnenrollPod(client kubernetes.Interface, pod *metav1.ObjectMeta) error {

var installerScope = log.RegisterScope("installer", "installer")

func init() {
	// adding to remove message about the controller-runtime logs not getting displayed
	// We cannot do this in the `log` package since it would place a runtime dependency on controller-runtime for all binaries.
	scope := log.RegisterScope("controlleruntime", "scope for controller runtime")

			NodeName: NodeName,
		},
		Status: corev1.PodStatus{
			PodIP: fakePodIP,
		},
	}
	ns := &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: "funkyns"}}

	client := kube.NewFakeClient(ns, pod)

	// We are expecting at most 1 calls to the mock, wait for them
	wg, waitForMockCalls := NewWaitForNCalls(t, 1)
	fs := &fakeServer{testWG: wg}

	fs.On("AddPodToMesh",
		ctx,
		pod,
		util.GetPodIPsIfPresent(pod),

		lbls[k] = v
	}
	// case where a user provided custom workload group has labels in the workload entry template field
	we := wg.Spec.Template
	if len(we.Labels) > 0 {
		fmt.Printf("Labels should be set in the metadata. The following WorkloadEntry labels will override metadata labels: %s\n", we.Labels)
		for k, v := range we.Labels {
			lbls[k] = v
		}
	}

	meshConfig.DefaultConfig.ReadinessProbe = wg.Spec.Probe

	if matches < possibleDests {
		// We've printed the match conditions.  We can't say for sure that matching
		// traffic will reach this pod, because an earlier match condition could have captured it.
		fmt.Fprintf(writer, "%s%d additional destination(s) that will not reach this pod\n",
			printSpaces(initPrintNum+printLevel1), possibleDests-matches)
		// If we matched, but printed nothing, treat this as the catch-all

	// ManifestsPath specifies where the manifests to render the mutatingwebhook can be found.
	// TODO(Monkeyanator) once we stop using Helm templating remove this.
	ManifestsPath string
	// Generate determines whether we should just generate the webhooks without applying. This
	// applying is not done here, but we are looser with checks when doing generate.
	Generate bool
	// Overwrite removes analysis checks around existing webhooks.

	}
}

func runPlugin() error {
	if err := log.Configure(plugin.GetLoggingOptions("")); err != nil {
		return err
	}
	defer func() {
		// Log sync will send logs to install-cni container via UDS.
		// We don't need a timeout here because underlying the log pkg already handles it.
		// this may fail, but it should be safe to ignore according
		// to https://github.com/uber-go/zap/issues/328
		_ = log.Sync()
	}()

	validateReferentialIntegrity(t, objsRev, "istiod-canary", istiodCanary16Selector)

	t.Run("cross revision", func(t *testing.T) {
		// Istiod revisions have complicated cross revision implications. We should assert these are correct
		// First we fetch all the objects for our default install
		cname := "istiod"
		deployment := mustFindObject(t, objs, cname, name.DeploymentStr)
		service := mustFindObject(t, objs, cname, name.ServiceStr)

)

// Exposed for testing constants
var (
	CNIBinDir          = "/opt/cni/bin"
	HostCNIBinDir      = "/host/opt/cni/bin"
	ServiceAccountPath = "/var/run/secrets/kubernetes.io/serviceaccount"
	// Well-known subpath we will mount any needed host-mounts under,
	// to preclude shadowing or breaking any pod-internal mounts
	HostMountsPath = "/host"

		installLog.Debugf("no preexisting kubeconfig at %s, assuming we need to create one", kubeconfigFilepath)
		return err
	}

	if expectedKC.Full == string(existingKC) {
		installLog.Debugf("preexisting kubeconfig %s is an exact match for expected, no need to update", kubeconfigFilepath)
		return nil
	}

	return fmt.Errorf("kubeconfig on disk differs from expected, assuming we need to rewrite it")