func V1DeepEqualSafePodSpec() corev1.PodSpec {
	grace := int64(30)
	return corev1.PodSpec{
		RestartPolicy:                 corev1.RestartPolicyAlways,
		DNSPolicy:                     corev1.DNSClusterFirst,
		TerminationGracePeriodSeconds: &grace,
		SecurityContext:               &corev1.PodSecurityContext{},
	}
}

func V1DeepEqualSafePodStatus() corev1.PodStatus {
	return corev1.PodStatus{

			ObjectMeta: metav1.ObjectMeta{Namespace: "three", Name: "three"},
			Spec: corev1.ServiceSpec{
				Ports: []corev1.ServicePort{{NodePort: 201}},
			},
		},
		&corev1.Service{ // empty, ignored
			ObjectMeta: metav1.ObjectMeta{Namespace: "four", Name: "four"},
			Spec: corev1.ServiceSpec{
				Ports: []corev1.ServicePort{{}},
			},
		},
		&corev1.Service{ // duplicate, dropped

			Spec: corev1.ServiceSpec{
				ClusterIP:  "2000::1",
				ClusterIPs: []string{"2000::1", "192.168.1.100"},
				IPFamilies: []corev1.IPFamily{corev1.IPv6Protocol, corev1.IPv4Protocol},
			},
		},
		&corev1.Service{
			ObjectMeta: metav1.ObjectMeta{Namespace: "x3", Name: "two-6"},
			Spec: corev1.ServiceSpec{
				ClusterIP:  "2000::2",
				ClusterIPs: []string{"2000::2"},
				IPFamilies: []corev1.IPFamily{corev1.IPv6Protocol},

	}
	corev1.SetDefaults_ResourceList(&in.Spec.Template.Spec.Overhead)
	for i := range in.Spec.VolumeClaimTemplates {
		a := &in.Spec.VolumeClaimTemplates[i]
		corev1.SetDefaults_PersistentVolumeClaim(a)
		corev1.SetDefaults_PersistentVolumeClaimSpec(&a.Spec)
		corev1.SetDefaults_ResourceList(&a.Spec.Resources.Limits)
		corev1.SetDefaults_ResourceList(&a.Spec.Resources.Requests)
		corev1.SetDefaults_ResourceList(&a.Status.Capacity)

		Status: corev1.PodStatus{
			Conditions: []corev1.PodCondition{
				{
					Type:               corev1.PodReady,
					Status:             corev1.ConditionTrue,
					LastTransitionTime: metav1.Now(),
				},
			},
			PodIP:  ip,
			HostIP: ip,
			PodIPs: []corev1.PodIP{
				{
					IP: ip,
				},
			},
			Phase: corev1.PodRunning,
		},
	}
}

	c := kube.NewFakeClient()
	pods := New[*corev1.Pod](c)
	c.RunAndWait(test.NewStop(t))
	var index *Index[string, *corev1.Pod]
	adds := atomic.NewInt32(0)
	index = CreateIndexWithDelegate[string, *corev1.Pod](pods, func(pod *corev1.Pod) []string {
		return []string{pod.Spec.ServiceAccountName}
	}, controllers.EventHandler[*corev1.Pod]{
		AddFunc: func(obj *corev1.Pod) {

func getNamespaces(ctx context.Context, client kube.CLIClient, istioNamespace string) ([]corev1.Namespace, error) {
	nslist, err := client.Kube().CoreV1().Namespaces().List(ctx, metav1.ListOptions{})
	if err != nil {
		return []corev1.Namespace{}, err
	}
	filtered := filterSystemNamespaces(nslist.Items, istioNamespace)
	filtered = slices.Filter(filtered, func(namespace corev1.Namespace) bool {
		return !ambient.InAmbient(&namespace)
	})

	c := kube.NewFakeClient(
		&corev1.Pod{
			ObjectMeta: metav1.ObjectMeta{
				Name:      "pod",
				Namespace: "namespace",
				Labels:    map[string]string{"app": "foo"},
			},
			Status: corev1.PodStatus{PodIP: "1.2.3.4"},
		},
		&corev1.Service{
			ObjectMeta: metav1.ObjectMeta{
				Name:      "svc",
				Namespace: "namespace",
			},

				Handler:    "bar",
				Overhead: &nodev1.Overhead{
					PodFixed: corev1.ResourceList{
						corev1.ResourceName(corev1.ResourceCPU):    resource.MustParse("100m"),
						corev1.ResourceName(corev1.ResourceMemory): resource.MustParse("1"),
					},
				},
			},
			pod:         newOverheadValidPod("no-resource-req-no-overhead", 1, core.ResourceRequirements{}, false),
			expectError: false,

	"testing"
	"time"

	"github.com/stretchr/testify/mock"
	corev1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/types"
	"k8s.io/client-go/kubernetes/fake"

	"istio.io/istio/pkg/config/constants"
	"istio.io/istio/pkg/test/util/assert"
)

func TestMeshDataplaneAddsAnnotationOnAdd(t *testing.T) {
	pod := &corev1.Pod{
		ObjectMeta: metav1.ObjectMeta{
			Name:      "test",