[k8s.gcr.io/kube-controller-manager:v1.21.14](https://console.cloud.google.com/gcr/images/k8s-artifacts-prod/us/kube-controller-manager) | [amd64](https://console.cloud.google.com/gcr/images/k8s-artifacts-prod/us/kube-controller-manager-amd64), [arm](https://console.cloud.google.com/gcr/images/k8s-artifacts-prod/us/kube-controller-manager-arm), [...

			}
		}
	}

	return revisions, nil
}

func Webhooks(ctx context.Context, client kube.CLIClient) ([]admitv1.MutatingWebhookConfiguration, error) {
	hooks, err := client.Kube().AdmissionregistrationV1().MutatingWebhookConfigurations().List(ctx, metav1.ListOptions{})
	if err != nil {
		return []admitv1.MutatingWebhookConfiguration{}, err
	}

	client := kube.NewFakeClient(ns, pod)

	// We are expecting at most 1 calls to the mock, wait for them
	wg, waitForMockCalls := NewWaitForNCalls(t, 1)
	fs := &fakeServer{testWG: wg}

	fs.On("AddPodToMesh",
		ctx,
		pod,
		util.GetPodIPsIfPresent(pod),
		"",
	).Return(nil)

	server := &meshDataplane{
		kubeClient: client.Kube(),
		netServer:  fs,
	}

	clients   map[string]kube.CLIClient
	rootFlags *RootFlags
	results   map[string][]byte
	objects   []runtime.Object
	version   string
}

func (f *fakeInstance) CLIClientWithRevision(rev string) (kube.CLIClient, error) {
	if _, ok := f.clients[rev]; !ok {
		var cliclient kube.CLIClient
		if f.version != "" {
			cliclient = kube.NewFakeClientWithVersion(f.version, f.objects...)
		} else {

			c := &Controller{cfg: tt.config}
			assert.Equal(t, c.matchesFilter(tt.pod), tt.want)
		})
	}
}

func fakeClient(pods ...*corev1.Pod) kube.Client {
	var csPods []runtime.Object

	for _, pod := range pods {
		csPods = append(csPods, pod.DeepCopy())
	}
	return kube.NewFakeClient(csPods...)
}

func makePodLabelMap(pods []*corev1.Pod) (podmap map[string]string) {
	podmap = map[string]string{}

	}

	var installed bool
	if orArgs.revision == "default" {
		installed, err = isControllerInstalled(kubeClient.Kube(), orArgs.operatorNamespace, "")
	} else {
		installed, err = isControllerInstalled(kubeClient.Kube(), orArgs.operatorNamespace, orArgs.revision)
	}

	if installed && err != nil {
		l.LogAndFatal(err)
	}
	if !installed && !orArgs.purge {

      waypoint: |
{{ .Files.Get "files/waypoint.yaml" | trim | indent 8 }}
{{- end }}
{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "kube-gateway") }}
      kube-gateway: |
{{ .Files.Get "files/kube-gateway.yaml" | trim | indent 8 }}
{{- end }}
{{- with .Values.sidecarInjectorWebhook.templates }}
{{ toYaml . | trim | indent 6 }}
{{- end }}

**Affected Versions**:
  - kube-apiserver v1.29.0 - v1.29.3
  - kube-apiserver v1.28.0 - v1.28.8
  - kube-apiserver <= v1.27.12

**Fixed Versions**:
  - kube-apiserver v1.29.4
  - kube-apiserver v1.28.9
  - kube-apiserver v1.27.13

This vulnerability was reported by tha3e1vl.

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  components:
    cni:
      enabled: true
      namespace: kube-system
    ztunnel:
      enabled: true
      namespace: kube-system
    ingressGateways:
    - name: istio-ingressgateway
      enabled: false
  values:

	"istio.io/istio/istioctl/pkg/cli"
	"istio.io/istio/pkg/kube"
)

func getPodsNameInDefaultNamespace(ctx cli.Context, toComplete string) ([]string, error) {
	client, err := ctx.CLIClient()
	if err != nil {
		return nil, err
	}
	ns := ctx.NamespaceOrDefault(ctx.Namespace())
	podList, err := client.Kube().CoreV1().Pods(ns).List(context.Background(), metav1.ListOptions{})
	if err != nil {