// Takes precedence over AlwaysInjectSelector.
	NeverInjectSelector []metav1.LabelSelector `json:"neverInjectSelector"`

	// AlwaysInjectSelector: Forces the injection on pods whose labels match this selector.
	// It's an array of label selectors, that will be OR'ed, meaning we will iterate
	// over it and stop at the first match
	AlwaysInjectSelector []metav1.LabelSelector `json:"alwaysInjectSelector"`

			},
		},
	}

	selectorSvc := makeService("selector.com", "selector", "0.0.0.0",
		map[string]int{"tcp-444": 444, "http-445": 445}, true, model.ClientSideLB)
	selectorSvc.Attributes.LabelSelectors = map[string]string{"app": "wle"}

	serviceTests = append(serviceTests, struct {
		externalSvc *config.Config
		services    []*model.Service
	}{
		externalSvc: selector,

							// A Kubernetes service with no endpoints means there are no endpoints at
							// all, so don't bother sending, as traffic will never work. If we did
							// send a wildcard listener, we may get into a situation where a scale
							// down leads to a listener conflict. Similarly, if we have a
							// labelSelector on the Service, then this may have endpoints not yet

- `LabelSelectors` specified in `topologySpreadConstraints` were validated to ensure that pods are scheduled as expected. Existing pods with invalid `LabelSelectors` could be updated, but new pods were required to specify valid `LabelSelectors`. ([#111802](https://github.com/kubernetes/kubernetes/pull/111802), [@maaoBit](https://github.com/maaoBit))

	extSvcSelector := buildServiceWithPort("example2.com", 9999, protocol.TCP, tnow)
	extSvcSelector.Resolution = model.Passthrough
	extSvcSelector.Attributes.ServiceRegistry = provider.External
	extSvcSelector.Attributes.LabelSelectors = map[string]string{"foo": "bar"}

	tests := []struct {
		name                      string
		instances                 []*model.ServiceInstance
		services                  []*model.Service

				NamespaceSelector:       &metav1.LabelSelector{},
				ObjectSelector:          &metav1.LabelSelector{},
				AdmissionReviewVersions: []string{"v1beta1"},
			}, {
				Name:              "shouldNotBeCalled",
				ClientConfig:      ccfgSVC("shouldNotBeCalled"),
				NamespaceSelector: &metav1.LabelSelector{},
				ObjectSelector: &metav1.LabelSelector{
					MatchLabels: map[string]string{

			expectedObj:             ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, ResourceVersionMatch: "m"},
		},
		{
			name:                    "no-op, Watch=false",
			watchListFeatureEnabled: true,

				Webhooks: []v1beta1.ValidatingWebhook{{
					FailurePolicy:           &ignore,
					MatchPolicy:             &exact,
					TimeoutSeconds:          &thirty,
					NamespaceSelector:       &metav1.LabelSelector{},
					ObjectSelector:          &metav1.LabelSelector{},
					SideEffects:             &unknown,
					AdmissionReviewVersions: []string{"v1beta1"},
				}},
			},
		},
		{
			name: "MutatingWebhookConfiguration",

			expectMatches: false,
		},
		{
			name: "wildcard rule, match as requested",
			criteria: &v1.MatchResources{
				NamespaceSelector: &metav1.LabelSelector{},
				ObjectSelector:    &metav1.LabelSelector{},
				ResourceRules: []v1.NamedRuleWithOperations{{
					RuleWithOperations: v1.RuleWithOperations{
						Operations: []v1.OperationType{"*"},

						{
							LabelSelector: &metav1.LabelSelector{
								MatchExpressions: []metav1.LabelSelectorRequirement{
									{
										Key:      "security",
										Operator: metav1.LabelSelectorOpIn,
										Values:   []string{"S2"},
									},
								},
							},
							TopologyKey: v1.LabelHostname,
						}, {
							LabelSelector: &metav1.LabelSelector{