matchPolicy: Equivalent
  name: rev.object.sidecar-injector.istio.io
  namespaceSelector:
    matchExpressions:
    - key: istio.io/rev
      operator: DoesNotExist
    - key: istio-injection
      operator: DoesNotExist
  objectSelector:
    matchExpressions:
    - key: sidecar.istio.io/inject
      operator: NotIn
      values:
      - "false"
    - key: istio.io/rev
      operator: In
      values:

				Prefix:   "default",
				Revision: "istio.io/rev=XXX",
			},
			wantRevision: "istio.io/rev=XXX",
		},
		{
			name:     "NoOverwriteNonEmptyInput",
			revision: "BadRevision",
			cfg: Config{
				Prefix:   "default",
				Revision: "istio.io/rev=XXX",
			},
			wantRevision: "istio.io/rev=XXX",
		},
		{
			name:     "OverwriteNonEmptyInput",
			revision: "istio.io/rev=canary",
			cfg: Config{
				Prefix:   "default",

    app: foo
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: foo-bar-rev-a
spec:
  replicas: 1
  selector:
    matchLabels:
      app: foo
      version: bar
  template:
    metadata:
      labels:
        app: foo
        version: bar
        test.istio.io/class: standard
        istio.io/rev: rev-a
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "15014"

# Namespace is explicitly enabled in the new style
apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio.io/rev: canary
  name: canary-test
---
# Namespace is explicitly enabled in the new style, but refers to a non-existent control plane
apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio.io/rev: pidgeon
  name: pidgeon-test
---
# Namespace has both old and new labels
apiVersion: v1
kind: Namespace

      port: 443
  failurePolicy: Fail
  matchPolicy: Equivalent
  name: rev.namespace.sidecar-injector.istio.io
  namespaceSelector:
    matchExpressions:
    - key: istio.io/rev
      operator: In
      values:
      - default
    - key: istio-injection
      operator: DoesNotExist
  objectSelector:
    matchExpressions:
    - key: istio.io/rev
      operator: NotIn
      values:
      - canary

// used in pseudo-versions (12 hex digits).
func ShortenSHA1(rev string) string {
	if AllHex(rev) && len(rev) == 40 {
		return rev[:12]
	}
	return rev
}

// WorkDir returns the name of the cached work directory to use for the
// given repository type and name.
func WorkDir(ctx context.Context, typ, name string) (dir, lockfile string, err error) {
	if cfg.GOMODCACHE == "" {

	//   every 5 minutes. This is very unlikely affecting or affected w.r.t. server load.

	var compactTime int64
	var rev int64
	var err error
	for {
		select {
		case <-time.After(interval):
		case <-ctx.Done():
			return
		}

		compactTime, rev, err = compact(ctx, client, compactTime, rev)
		if err != nil {
			klog.Errorf("etcd: endpoint (%v) compact failed: %v", client.Endpoints(), err)
			continue
		}

			return r
		}
		if semver.Build(rev) == "+incompatible" {
			rev = rev[:len(rev)-len("+incompatible")]
		}
		if r.codeDir == "" {
			return rev
		}
		return r.codeDir + "/" + rev
	}
	return rev
}

func (r *codeRepo) versionToRev(version string) (rev string, err error) {
	if !semver.IsValid(version) {
		return "", &module.ModuleError{
			Path: r.modPath,

if meta=$(go mod download -json "${replacement}@${sha}"); then
    rev=$(echo "${meta}" | jq -r ".Version")
else
    error=$(echo "${meta}" | jq -r ".Error")
    echo "Download failed: ${error}" >&2
    exit 1
fi
echo "Resolved to ${replacement}@${rev}"

# Add the require directive
echo "Running: go mod edit -require ${dep}@${rev}"
go mod edit -require "${dep}@${rev}"

# Add the replace directive

// GoMod is like Lookup(ctx, path).GoMod(rev) but avoids the
// repository path resolution in Lookup if the result is
// already cached on local disk.
func GoMod(ctx context.Context, path, rev string) ([]byte, error) {
	// Convert commit hash to pseudo-version
	// to increase cache hit rate.
	if !gover.ModIsValid(path, rev) {
		if _, info, err := readDiskStat(ctx, path, rev); err == nil {
			rev = info.Version
		} else {