tests := []struct {
		opts      metav1.PatchOptions
		patchType types.PatchType
	}{{
		opts: metav1.PatchOptions{
			Force:        boolPtr(true),
			FieldManager: "kubectl",
		},
		patchType: types.ApplyPatchType,
	}, {
		opts: metav1.PatchOptions{
			FieldManager: "kubectl",
		},
		patchType: types.ApplyPatchType,
	}, {
		opts:      metav1.PatchOptions{},
		patchType: types.MergePatchType,
	}, {

		constants.DataplaneModeLabel, constants.DataplaneModeAmbient))
	_, err := client.Kube().CoreV1().Namespaces().Patch(ctx, ns.Name,
		types.MergePatchType, labelsPatch, metav1.PatchOptions{})
	assert.NoError(t, err)

	waitForMockCalls()

	assertPodAnnotated(t, client, pod)

	// Assert expected calls actually made
	fs.AssertExpectations(t)
}

		if err != nil {
			return nil, err
		}
		return c.Istio().SecurityV1beta1().AuthorizationPolicies(orig.Namespace).
			Patch(context.TODO(), orig.Name, typ, patchBytes, metav1.PatchOptions{FieldManager: "pilot-discovery"})
	case gvk.DestinationRule:
		oldRes := &apiistioioapinetworkingv1alpha3.DestinationRule{
			ObjectMeta: origMeta,

			assert.True(t, apierrors.IsNotFound(err))

			_, err = otherScopeClient.Patch(context.TODO(), name, types.MergePatchType, []byte(`{"metadata":{"annotations":{"test":"1"}}}`), metav1.PatchOptions{}, "status")
			assert.True(t, apierrors.IsNotFound(err))

		constants.DataplaneModeLabel, constants.DataplaneModeAmbient))
	_, err := client.Kube().CoreV1().Namespaces().Patch(ctx, ns.Name,
		types.MergePatchType, labelsPatch, metav1.PatchOptions{})
	assert.NoError(t, err)

	client.RunAndWait(ctx.Done())

	payload, _ := json.Marshal(valid)

	// serialize our fake plugin event
	addEvent, err := processAddEvent(payload)

			err := errors.NewInvalid(schema.GroupKind{Group: metav1.GroupName, Kind: "PatchOptions"}, "", errs)
			scope.err(err, w, req)
			return
		}
		options.TypeMeta.SetGroupVersionKind(metav1.SchemeGroupVersion.WithKind("PatchOptions"))

		admit = admission.WithAudit(admit)

		audit.LogRequestPatch(req.Context(), patchBytes)
		span.AddEvent("Recorded the audit event")

			if err == nil {
				t.Fatalf("unexpected non-error: strategic merge patch is not supported for custom resources")
			}

			_, err = noxuResourceClient.Patch(context.TODO(), "foo", types.StrategicMergePatchType, patch, metav1.PatchOptions{}, "scale")
			if err == nil {

	_, err := client.CoreV1().
		Pods(pod.Namespace).
		Patch(
			context.Background(),
			pod.Name,
			types.MergePatchType,
			annotationPatch,
			metav1.PatchOptions{},
			// Both "pods" and "pods/status" can mutate the metadata. However, pods/status is lower privilege, so we use that instead.
			"status",
		)
	return err
}

	return n.forEachCluster(func(_ int, c cluster.Cluster) error {
		_, err := c.Kube().CoreV1().Namespaces().Patch(context.TODO(), n.name, types.JSONPatchType, []byte(nsLabelPatch), metav1.PatchOptions{})
		return err
	})
}

// removeNamespaceLabel removes namespace label with the given key
func (n *kubeNamespace) removeNamespaceLabel(key string) error {

			patch := []byte(fmt.Sprintf(`{"i": %d}`, i))
			i++

			_, err := noxuNamespacedResourceClientV1beta1.Patch(context.TODO(), "foo", types.MergePatchType, patch, metav1.PatchOptions{})
			if err != nil {
				// work around "grpc: the client connection is closing" error
				// TODO: fix the grpc error
				if err, ok := err.(*errors.StatusError); ok && err.Status().Code == http.StatusInternalServerError {