ls, err := LabelSelectorAsSelector(selector)
		if err != nil {
			log.Errorf("error initializing discovery namespaces filter, invalid discovery selector: %v", err)
			return
		}
		selectors = append(selectors, ls)
	}

	// range over all namespaces to get discovery namespaces
	for _, ns := range namespaceList {
		for _, selector := range selectors {
			if selector.Matches(labels.Set(ns.Labels)) {

  // freshness marks whether a group version's discovery document is up to date.
  // "Current" indicates the discovery document was recently
  // refreshed. "Stale" indicates the discovery document could not
  // be retrieved and the returned discovery document may be
  // significantly out of date. Clients that require the latest
  // version of the discovery information be retrieved before

apiVersion: release-notes/v2
kind: feature
area: telemetry
issue: []
releaseNotes:
  - |

	"golang.org/x/time/rate"

	v1 "k8s.io/api/core/v1"
	discovery "k8s.io/api/discovery/v1"
	apierrors "k8s.io/apimachinery/pkg/api/errors"
	"k8s.io/apimachinery/pkg/labels"
	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
	"k8s.io/apimachinery/pkg/util/wait"
	coreinformers "k8s.io/client-go/informers/core/v1"
	discoveryinformers "k8s.io/client-go/informers/discovery/v1"
	clientset "k8s.io/client-go/kubernetes"

	WebService() *restful.WebService
}

// rootAPIsHandler creates a webservice serving api group discovery.
// The list of APIGroups may change while the server is running because additional resources
// are registered or removed.  It is not safe to cache the values.
type rootAPIsHandler struct {
	// addresses is used to build cluster IPs for discovery.
	addresses Addresses

	serializer runtime.NegotiatedSerializer

SataQiu <******@****.***> 1702613527 +0800

SataQiu <******@****.***> 1713430345 +0800

    sds -> ca [label="CSR"]

    xdsproxy -> discovery [dir=both,label="ADS"]

    envoy [shape=hexagon, color=purple]

    subgraph cluster_istioagent {
        label = "Istio Agent"
        color="orange"
        sds
        xdsproxy
    }

    subgraph cluster_istiod {
        label = "Istiod"
        color="lightblue"
        ca
        discovery
    }

See the License for the specific language governing permissions and
limitations under the License.
*/

// +k8s:deepcopy-gen=package
// +groupName=discovery.k8s.io

	TokenDiscovery = "discovery-token"

	// TokenDiscoveryCAHash flag instructs kubeadm to validate that the root CA public key matches this hash (for token-based discovery)
	TokenDiscoveryCAHash = "discovery-token-ca-cert-hash"

	// TokenDiscoverySkipCAHash flag instructs kubeadm to skip CA hash verification (for token-based discovery)