name string
		arg  []string
		want map[string]string
	}{
		{name: "empty", arg: []string{""}, want: map[string]string{"": ""}},
		{name: "one-valid", arg: []string{"key=value"}, want: map[string]string{"key": "value"}},
		{name: "one-valid-double-equals", arg: []string{"key==value"}, want: map[string]string{"key": "=value"}},
		{name: "one-key-only", arg: []string{"key"}, want: map[string]string{"key": ""}},
	}

		return
	}

	actionToPolicy := map[rbacpb.RBAC_Action]map[string]struct{}{}
	policyToRule := map[string]map[string]struct{}{}

	addPolicy := func(action rbacpb.RBAC_Action, name string, rule string) {
		if actionToPolicy[action] == nil {
			actionToPolicy[action] = map[string]struct{}{}
		}
		if policyToRule[name] == nil {
			policyToRule[name] = map[string]struct{}{}
		}

type PodNetnsCache interface {
	ReadCurrentPodSnapshot() map[string]WorkloadInfo
}

// Hold a cache of node local pods with their netns
// if we don't know the netns, the pod will still be here with a nil netns.
type podNetnsCache struct {
	openNetns func(nspath string) (NetnsCloser, error)

	currentPodCache map[string]WorkloadInfo
	mu              sync.RWMutex
}

type WorkloadInfo struct {

  // the list automatically by PodDisruptionBudget controller after some time.
  // If everything goes smooth this map should be empty for the most of the time.
  // Large number of entries in the map may indicate problems with pod deletions.
  // +optional
  map<string, k8s.io.apimachinery.pkg.apis.meta.v1.Time> disruptedPods = 2;

  // Number of pod disruptions that are currently allowed.

// Overhead structure represents the resource overhead associated with running a pod.
message Overhead {
  // podFixed represents the fixed resource overhead associated with running a pod.
  // +optional
  map<string, k8s.io.apimachinery.pkg.api.resource.Quantity> podFixed = 1;
}

// RuntimeClass defines a class of container runtime supported in the cluster.
// The RuntimeClass is used to determine which container runtime is used to run

	"istio.io/istio/pkg/test/util/assert"
)

var (
	defaultRevisionCanonicalWebhook = admitv1.MutatingWebhookConfiguration{
		ObjectMeta: metav1.ObjectMeta{
			Name:   "istio-sidecar-injector",
			Labels: map[string]string{label.IoIstioRev.Name: "default"},
		},
		Webhooks: []admitv1.MutatingWebhook{
			{
				Name: fmt.Sprintf("namespace.%s", istioInjectionWebhookSuffix),
				ClientConfig: admitv1.WebhookClientConfig{

				if err != nil {
					return nil, err
				}
				return map[string]*discovery.DiscoveryResponse{
					CpInfo(response).ID: response,
				}, nil
			}
		}
		return nil, err
	}
	return mapShards(responses)
}

func mapShards(responses []*discovery.DiscoveryResponse) (map[string]*discovery.DiscoveryResponse, error) {
	retval := map[string]*discovery.DiscoveryResponse{}

)

func TestXdsStatusWriter_PrintAll(t *testing.T) {
	tests := []struct {
		name    string
		input   map[string]*discovery.DiscoveryResponse
		want    string
		wantErr bool
	}{
		{
			name: "prints multiple istiod inputs to buffer in alphabetical order by pod name",
			input: map[string]*discovery.DiscoveryResponse{
				"istiod1": xdsResponseInput("istiod1", []clientConfigInput{
					{

// limitations under the License.

package cmd

import (
	"errors"
	"testing"

	"istio.io/istio/istioctl/pkg/analyze"
	"istio.io/istio/istioctl/pkg/util"
)

var KnownErrorCode = map[error]int{
	errors.New("unknown command"):                                  ExitIncorrectUsage,
	errors.New("unexpected error"):                                 ExitUnknownError,

	assert.Equal(t, len(podIPs), 0)
}

func TestPodRedirectionEnabled(t *testing.T) {
	var (
		ambientEnabledLabel     = map[string]string{constants.DataplaneModeLabel: constants.DataplaneModeAmbient}
		ambientDisabledLabel    = map[string]string{constants.DataplaneModeLabel: constants.DataplaneModeNone}
		sidecarStatusAnnotation = map[string]string{annotation.SidecarStatus.Name: "test"}

		namespaceWithAmbientEnabledLabel = &corev1.Namespace{