"istio.io/api/annotation"
	"istio.io/api/label"
	"istio.io/istio/pkg/config/constants"
)

var annotationPatch = []byte(fmt.Sprintf(
	`{"metadata":{"annotations":{"%s":"%s"}}}`,
	annotation.AmbientRedirection.Name,
	constants.AmbientRedirectionEnabled,
))

var annotationRemovePatch = []byte(fmt.Sprintf(
	`{"metadata":{"annotations":{"%s":null}}}`,
	annotation.AmbientRedirection.Name,
))

import java.io.ByteArrayInputStream;
import java.io.File;
import java.io.InputStream;
import java.io.Reader;
import java.io.StringReader;
import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;
import java.lang.reflect.Array;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import java.lang.reflect.Type;

		if !errors.Is(err, ErrPartialAdd) {
			return err
		}
		retErr = err
	}

	log.Debugf("annotating pod %s", pod.Name)
	if err := util.AnnotateEnrolledPod(s.kubeClient, &pod.ObjectMeta); err != nil {
		log.Errorf("failed to annotate pod enrollment: %v", err)
		retErr = err
	}

	// ipset is only relevant for pod healthchecks.

import java.io.ByteArrayInputStream;
import java.io.File;
import java.io.InputStream;
import java.io.Reader;
import java.io.StringReader;
import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;
import java.lang.reflect.Array;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import java.lang.reflect.Type;

  static boolean isNullable(Parameter param) {
    return NULLNESS_ANNOTATION_READER.isNullable(param);
  }

  private static boolean containsNullable(Annotation[] annotations) {
    for (Annotation annotation : annotations) {
      if (NULLABLE_ANNOTATION_SIMPLE_NAMES.contains(annotation.annotationType().getSimpleName())) {
        return true;
      }
    }
    return false;
  }

  private boolean isIgnored(Member member) {

	// We use the SidecarTrafficExcludeInboundPorts annotation for compatibility (its somewhat widely used) but don't support all values.
	ingressMode := false
	if a, f := pod.Annotations[annotation.AmbientBypassInboundCapture.Name]; f {
		var err error
		ingressMode, err = strconv.ParseBool(a)
		if err != nil {
			log.Warnf("annotation %v=%q found, but only '*' is supported", annotation.AmbientBypassInboundCapture.Name, a)
		}
	}

          <item index="3" class="java.lang.String" itemvalue="com.android.annotations.Nullable" />
          <item index="4" class="java.lang.String" itemvalue="edu.umd.cs.findbugs.annotations.Nullable" />
          <item index="5" class="java.lang.String" itemvalue="io.reactivex.annotations.Nullable" />
          <item index="6" class="java.lang.String" itemvalue="io.reactivex.rxjava3.annotations.Nullable" />

	}{
		{
			name: "Injection disabled by annotation",
			pod: &corev1.Pod{
				ObjectMeta: metav1.ObjectMeta{
					Annotations: map[string]string{
						annotation.SidecarInject.Name: "false",
					},
				},
			},
			expected: true,
		},
		{
			name: "Injection enabled by annotation",
			pod: &corev1.Pod{
				ObjectMeta: metav1.ObjectMeta{
					Annotations: map[string]string{

				" --annotations annotation=foobar --ports grpc=3550,http=8080 --serviceAccount test", " "),
			expectedException: false,
			expectedOutput:    customYAML,
		},
		{
			description: "valid case - create full workload group with shortnames",
			args: strings.Split("group create --name foo -n bar -l app=foo,bar=baz -p grpc=3550,http=8080"+
				" -a annotation=foobar --serviceAccount test", " "),

		},
		{
			name: "include-exclude-ports",
			annotations: map[string]string{
				annotation.SidecarStatus.Name:                      "true",
				annotation.SidecarTrafficIncludeInboundPorts.Name:  "1111,2222",
				annotation.SidecarTrafficExcludeInboundPorts.Name:  "3333,4444",
				annotation.SidecarTrafficExcludeOutboundPorts.Name: "5555,6666",
			},
			proxyEnv: []corev1.EnvVar{},