func checkCmd(ctx cli.Context) *cobra.Command {
	cmd := &cobra.Command{
		Use:   "check [<type>/]<name>[.<namespace>]",
		Short: "Check AuthorizationPolicy applied in the pod.",
		Long: `Check prints the AuthorizationPolicy applied to a pod by directly checking
the Envoy configuration of the pod. The command is especially useful for inspecting
the policy propagation from Istiod to Envoy and the final AuthorizationPolicy list merged

          sum(labels('container_memory_working_set_bytes', containerLabels), by=['pod'])
        ),
        self.query(
          'Stack ({{pod}})',
          sum(labels('go_memstats_stack_inuse_bytes', appLabels), by=['pod'])
        ),
        self.query(
          'Heap (In Use) ({{pod}})',
          sum(labels('go_memstats_heap_inuse_bytes', appLabels), by=['pod'])
        ),
        self.query(

// Kubernetes, as specified in requests and limits, describing each pod in the
// current scale target (e.g. CPU or memory).  The values will be averaged
// together before being compared to the target.  Such metrics are built in to
// Kubernetes, and have special scaling options on top of those available to
// normal per-pod metrics using the "pods" source.  Only one "target" type
// should be set.

// * use crictl to inspect the pod; this returns the bind-mounted network namespace file.
// * /var/lib/cni/results shows the outputs of CNI plugins; this containers the bind-mounted network namespace file.
//
// Instead, we traverse the procfs. Comments on this method are inline.
func getPodNetNs(pod *corev1.Pod) (string, error) {
	parsedPodAddr := net.ParseIP(pod.Status.PodIP)
	if parsedPodAddr == nil {

// Kubernetes, as specified in requests and limits, describing each pod in the
// current scale target (e.g. CPU or memory).  The values will be averaged
// together before being compared to the target.  Such metrics are built in to
// Kubernetes, and have special scaling options on top of those available to
// normal per-pod metrics using the "pods" source.  Only one "target" type
// should be set.

      },
      "endpoints": {
        "Kubernetes//Pod/bookinfo/reviews-v2-5b667bcbf8-q5pn2:/10.244.1.38": {
          "workloadUid": "Kubernetes//Pod/bookinfo/reviews-v2-5b667bcbf8-q5pn2",
          "service": "bookinfo/reviews.bookinfo.svc.cluster.local",
          "address": "/10.244.1.38",
          "port": {
            "9080": 9080
          }
        },
        "Kubernetes//Pod/bookinfo/reviews-v1-5b5d6494f4-qwjv4:/10.244.1.37": {

  // in a pod.
  // The runtimeHandler must be lowercase, conform to the DNS Label (RFC 1123)
  // requirements, and is immutable.
  optional string runtimeHandler = 1;

  // overhead represents the resource overhead associated with running a pod for a
  // given RuntimeClass. For more details, see
  // https://git.k8s.io/enhancements/keps/sig-node/688-pod-overhead/README.md
  // +optional

  // +optional
  optional bool readOnly = 2;
}

// Eviction evicts a pod from its node subject to certain policies and safety constraints.
// This is a subresource of Pod.  A request to cause such an eviction is
// created by POSTing to .../pods/<pod name>/evictions.
message Eviction {
  // ObjectMeta describes the pod that is being evicted.
  // +optional

	client.RunAndWait(ctx.Done())

	t.Run("found pod", func(t *testing.T) {
		p, err := pluginServer.getPodWithRetry(log, pod.Name, pod.Namespace)
		assert.NoError(t, err)
		assert.Equal(t, p, pod)
	})
	t.Run("no pod", func(t *testing.T) {
		p, err := pluginServer.getPodWithRetry(log, "fake", pod.Namespace)
		assert.Error(t, err)
		assert.Equal(t, p, nil)
	})
	t.Run("pod out of ambient", func(t *testing.T) {

			pod := buildFakeDryRunPod()
			pod.ObjectMeta.Annotations = tt.annotations
			pod.Spec.Containers[1].Env = tt.proxyEnv

			pod.Spec.Containers[1].SecurityContext = &corev1.SecurityContext{}

			if tt.customGID != nil {
				pod.Spec.Containers[1].SecurityContext.RunAsGroup = tt.customGID
			}

			if tt.customUID != nil {