-I ISTIO_INBOUND 1 -p tcp -m mark --mark 1337 -j RETURN
-I ISTIO_INBOUND 2 -p tcp -s 127.0.0.6/32 -i lo -j RETURN
-I ISTIO_INBOUND 3 -p tcp -i lo -m mark ! --mark 1338 -j RETURN
COMMIT
* nat
-N ISTIO_INBOUND
-N ISTIO_REDIRECT
-N ISTIO_IN_REDIRECT
-N ISTIO_OUTPUT
-A ISTIO_INBOUND -p tcp --dport 15008 -j RETURN
-A ISTIO_REDIRECT -p tcp -j REDIRECT --to-ports 15001

	}

	ctx := cli.NewFakeContext(&cli.NewFakeContextOption{
		IstioNamespace: "istio-system",
	})
	client, err := ctx.CLIClient()
	if err != nil {
		t.Fatal(err)
	}
	client.Kube().CoreV1().Pods("istio-system").Create(context.TODO(), &corev1.Pod{
		ObjectMeta: metav1.ObjectMeta{
			Name:      "prometheus",
			Namespace: "istio-system",
			Labels: map[string]string{
				"app.kubernetes.io/name": "prometheus",
			},
		},

	}

	return nil
}

func (s *CniPluginServer) getPodWithRetry(log *istiolog.Scope, name, namespace string) (*corev1.Pod, error) {
	log.Debugf("Checking if pod %s/%s is enabled for ambient", namespace, name)
	const maxStaleRetries = 10
	const msInterval = 10
	retries := 0
	var ambientPod *corev1.Pod
	var err error

# For most projects, this workflow file will not need changing; you simply need
# to commit it to your repository.
#
# You may wish to alter this file to override the set of languages analyzed,
# or to provide custom queries or build logic.
name: "CodeQL"

on:
  push:
    branches: [master]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [master]
  schedule:
    - cron: '0 9 * * 3'

jobs:

  + Check for unnecessary whitespace with `git diff --check` before committing.
+ Make sure your commit messages are in the proper format. Your commit message should contain the key of the JIRA issue.
```
[MNG-XXX] - Subject of the JIRA Ticket
 Optional supplemental description.
```
+ Make sure you have added the necessary tests (JUnit/[Core IT tests][core-it]) for your changes.

// See the License for the specific language governing permissions and
// limitations under the License.

package tag

import (
	"context"
	"fmt"

	admitv1 "k8s.io/api/admissionregistration/v1"
	corev1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

	"istio.io/api/label"
	iopv1alpha1 "istio.io/istio/operator/pkg/apis"
	"istio.io/istio/pkg/kube"
)

				if err != nil {
					return err
				}
				pod, err := kubeClient.Kube().CoreV1().Pods(podNs).Get(context.TODO(), podName, metav1.GetOptions{})
				if err != nil {
					return err
				}
				ns, err := kubeClient.Kube().CoreV1().Namespaces().Get(context.TODO(), podNs, metav1.GetOptions{})
				if err != nil {
					return err
				}
				podLabels = pod.GetLabels()

}

func CommitOrRollbackTransaction(db *gorm.DB) {
	if !db.Config.SkipDefaultTransaction {
		if _, ok := db.InstanceGet("gorm:started_transaction"); ok {
			if db.Error != nil {
				db.Rollback()
			} else {
				db.Commit()
			}

			db.Statement.ConnPool = db.ConnPool
		}
	}

// See the License for the specific language governing permissions and
// limitations under the License.

package nodeagent

import (
	"context"
	"embed"
	"io/fs"
	"sync/atomic"
	"syscall"

	corev1 "k8s.io/api/core/v1"

	"istio.io/istio/cni/pkg/iptables"
)

//go:embed testdata/cgroupns
var fakeProc embed.FS

type fakeZtunnel struct {
	deletedPods atomic.Int32
	addedPods   atomic.Int32
	addError    error

  - type: checkboxes
    id: help
    attributes:
      label: Commit to Help
      description: |
        After submitting this, I commit to one of:

          * Read open questions until I find 2 where I can help someone and add a comment to help there.
          * I already hit the "watch" button in this repository to receive notifications and I commit to help at least 2 people that ask questions in the future.