func TestCollectionJoin(t *testing.T) {
	c := kube.NewFakeClient()
	pods := krt.NewInformer[*corev1.Pod](c)
	services := krt.NewInformer[*corev1.Service](c)
	serviceEntries := krt.NewInformer[*istioclient.ServiceEntry](c)
	c.RunAndWait(test.NewStop(t))
	pc := clienttest.Wrap(t, kclient.New[*corev1.Pod](c))
	sc := clienttest.Wrap(t, kclient.New[*corev1.Service](c))
	sec := clienttest.Wrap(t, kclient.New[*istioclient.ServiceEntry](c))

			},
		},
	})
	g.AddPod(&corev1.Pod{
		ObjectMeta: metav1.ObjectMeta{Name: "pod2-node2", Namespace: "ns1"},
		Spec: corev1.PodSpec{
			NodeName: "node2",
			Volumes: []corev1.Volume{
				{VolumeSource: corev1.VolumeSource{Secret: &corev1.SecretVolumeSource{SecretName: "node1-node2-only"}}},

func PodRedirectionActive(pod *corev1.Pod) bool {
	return pod.GetAnnotations()[constants.AmbientRedirection] == constants.AmbientRedirectionEnabled
}

func podHasSidecar(pod *corev1.Pod) bool {
	if _, f := pod.GetAnnotations()[annotation.SidecarStatus.Name]; f {
		return true
	}
	return false
}

func IsZtunnelPod(systemNs string, pod *corev1.Pod) bool {

					"key1":                   "val1",
					corev1.LabelTopologyZone: "zone1",
				},
			},
			internal: discovery.Endpoint{
				DeprecatedTopology: map[string]string{
					"key1": "val1",
				},
				Zone: utilpointer.String("zone1"),
			},
		},
		{
			desc: "only zone in topology map",
			external: v1beta1.Endpoint{
				Topology: map[string]string{
					corev1.LabelTopologyZone: "zone1",
				},
			},

		existingConfigMap *corev1.ConfigMap

		expectedErr     error
		expectedActions []core.Action
	}{
		{
			name:          "create configmap [no cache, no live object]",
			clientObjects: []runtime.Object{},
			expectedActions: []core.Action{

	makeDetectPod := func(name string, terminationMessage string, exitCode int) *corev1.Pod {
		return makePod(makePodArgs{
			PodName:     name,
			Annotations: map[string]string{"sidecar.istio.io/status": "something"},
			InitContainerStatus: &corev1.ContainerStatus{
				Name: constants.ValidationContainerName,
				State: corev1.ContainerState{
					Waiting: &corev1.ContainerStateWaiting{
						Reason:  "CrashLoopBackOff",

		network:   networkID,
		index:     idx.(*index),
		fx:        up,
		pc:        clienttest.NewDirectClient[*corev1.Pod, corev1.Pod, *corev1.PodList](t, cl),
		sc:        clienttest.NewDirectClient[*corev1.Service, corev1.Service, *corev1.ServiceList](t, cl),
		ns:        clienttest.NewWriter[*corev1.Namespace](t, cl),
		grc:       clienttest.NewWriter[*k8sbeta.Gateway](t, cl),

	r.reconcilingLock.Lock()
	defer r.reconcilingLock.Unlock()

	if r.stopReconcilingCalled {
		return nil
	}

	e, err := r.epAdapter.Get(metav1.NamespaceDefault, serviceName, metav1.GetOptions{})
	if err != nil {
		e = &corev1.Endpoints{
			ObjectMeta: metav1.ObjectMeta{
				Name:      serviceName,

	// clone all annotations but EndpointsLastChangeTriggerTime and LastAppliedConfigAnnotation
	for annotation, val := range endpoints.Annotations {
		if annotation == corev1.EndpointsLastChangeTriggerTime || annotation == corev1.LastAppliedConfigAnnotation {
			continue
		}
		epSlice.Annotations[annotation] = val
	}

	if sliceName == "" {
		epSlice.GenerateName = getEndpointSlicePrefix(endpoints.Name)
	} else {

	}

	testcases := []struct {
		description   string
		cacheInput    []*corev1.ResourceQuota
		clientInput   []runtime.Object
		ttl           time.Duration
		namespace     string
		expectedQuota *corev1.ResourceQuota
	}{
		{
			description:   "object is found via cache",
			cacheInput:    []*corev1.ResourceQuota{resourceQuota},
			ttl:           30 * time.Second,
			namespace:     namespace,
			expectedQuota: resourceQuota,