// container crashes or exits. The Pod's termination grace period countdown begins before the
  // PreStop hook is executed. Regardless of the outcome of the handler, the
  // container will eventually terminate within the Pod's termination grace
  // period (unless delayed by finalizers). Other management of the container blocks until the hook completes
  // or until the termination grace period is reached.

	if netns1 != netnsTaken {
		t.Fatalf("Expected the original Netns for the same uid, got %p and %p", netns1, ns)
	}
	if nil != p.Take(string(pod.UID)) {
		// expect nil because we already took it
		t.Fatalf("Expected nil Netns for the same uid twice")
	}
}

var counter atomic.Int64

func inc() uintptr {
	return uintptr(counter.Add(1))

// 		runtime.TypeMeta `json:",inline"`
// 		MyPlugin runtime.RawExtension `json:"myPlugin"`
// 	}
//
// 	type PluginA struct {
// 		AOption string `json:"aOption"`
// 	}
//
// // On the wire, the JSON will look something like this:
//
// 	{
// 		"kind":"MyAPIObject",
// 		"apiVersion":"v1",
// 		"myPlugin": {
// 			"kind":"PluginA",
// 			"aOption":"foo",
// 		},
// 	}
//

				fmt.Fprintf(cmd.OutOrStdout(),
					"Warning: No Kubernetes Services select pod %s (see https://istio.io/docs/setup/kubernetes/additional-setup/requirements/ )\n", // nolint: lll
					kname(pod.ObjectMeta))
			}
			// TODO look for port collisions between services targeting this pod

			kubeClient, err := ctx.CLIClientWithRevision(opts.Revision)
			if err != nil {
				return err
			}

			configClient := client.Istio()

Next, for an individual proxy we will check if it could possibly be impacted by the change. For example, we know a sidecar never is impacted by a `Gateway` update, and we can also look at scoping (from `Sidecar.egress.hosts`) to further restrict update scopes.

  // changes any of the owned fields value or removes a field. The
  // timestamp does not update when a field is removed from the entry
  // because another manager took it over.
  // +optional
  optional Time time = 4;

  // FieldsType is the discriminator for the different fields format and version.
  // There is currently only one possible value: "FieldsV1"

	fmt.Fprintln(w, "NAMESPACES\tINJECTOR-HOOK\tISTIO-REVISION\tSIDECAR-IMAGE")
	for _, hook := range hooks {
		revision := hook.ObjectMeta.GetLabels()[label.IoIstioRev.Name]
		namespaces := getMatchingNamespaces(&hook, namespaces)
		if len(namespaces) == 0 {
			fmt.Fprintf(w, "%s\t%s\t%s\t%s\n", "DOES NOT AUTOINJECT", hook.Name, revision, injectedImages[revision])
			continue
		}

					if want, ok := predicate(s); ok {
						if want != found {
							t.Fatalf("expected webhook to go to service %q, found %q", want, found)
						}
						return
					}
					// Otherwise, look through our assertions for a matching one, and check that
					for _, w := range tt.checks {
						if w.namespaceLabel.String() == s.namespace.String() && w.objectLabel.String() == s.pod.String() {
							if found != w.match {