Next, for an individual proxy we will check if it could possibly be impacted by the change. For example, we know a sidecar never is impacted by a `Gateway` update, and we can also look at scoping (from `Sidecar.egress.hosts`) to further restrict update scopes.

  // "imagepolicy" is the name of the webhook, and kubernetes.io is the name
  // of the organization.
  // Required.
  optional string name = 1;

  // ClientConfig defines how to communicate with the hook.
  // Required
  optional WebhookClientConfig clientConfig = 2;

  // Rules describes what operations on what resources/subresources the webhook cares about.
  // The webhook cares about an operation if it matches _any_ Rule.

  // "imagepolicy" is the name of the webhook, and kubernetes.io is the name
  // of the organization.
  // Required.
  optional string name = 1;

  // ClientConfig defines how to communicate with the hook.
  // Required
  optional WebhookClientConfig clientConfig = 2;

  // Rules describes what operations on what resources/subresources the webhook cares about.
  // The webhook cares about an operation if it matches _any_ Rule.

  // container crashes or exits. The Pod's termination grace period countdown begins before the
  // PreStop hook is executed. Regardless of the outcome of the handler, the
  // container will eventually terminate within the Pod's termination grace
  // period (unless delayed by finalizers). Other management of the container blocks until the hook completes
  // or until the termination grace period is reached.

	if netns1 != netnsTaken {
		t.Fatalf("Expected the original Netns for the same uid, got %p and %p", netns1, ns)
	}
	if nil != p.Take(string(pod.UID)) {
		// expect nil because we already took it
		t.Fatalf("Expected nil Netns for the same uid twice")
	}
}

var counter atomic.Int64

func inc() uintptr {
	return uintptr(counter.Add(1))

  // changes any of the owned fields value or removes a field. The
  // timestamp does not update when a field is removed from the entry
  // because another manager took it over.
  // +optional
  optional Time time = 4;

  // FieldsType is the discriminator for the different fields format and version.
  // There is currently only one possible value: "FieldsV1"

					if want, ok := predicate(s); ok {
						if want != found {
							t.Fatalf("expected webhook to go to service %q, found %q", want, found)
						}
						return
					}
					// Otherwise, look through our assertions for a matching one, and check that
					for _, w := range tt.checks {
						if w.namespaceLabel.String() == s.namespace.String() && w.objectLabel.String() == s.pod.String() {
							if found != w.match {

	fmt.Fprintln(w, "NAMESPACES\tINJECTOR-HOOK\tISTIO-REVISION\tSIDECAR-IMAGE")
	for _, hook := range hooks {
		revision := hook.ObjectMeta.GetLabels()[label.IoIstioRev.Name]
		namespaces := getMatchingNamespaces(&hook, namespaces)
		if len(namespaces) == 0 {
			fmt.Fprintf(w, "%s\t%s\t%s\t%s\n", "DOES NOT AUTOINJECT", hook.Name, revision, injectedImages[revision])
			continue
		}