// +optional
  optional bool suspend = 10;
}

// JobStatus represents the current state of a Job.
message JobStatus {
  // The latest available observations of an object's current state. When a Job
  // fails, one of the conditions will have type "Failed" and status true. When
  // a Job is suspended, one of the conditions will have type "Suspended" and
  // status true; when the Job is resumed, the status of this condition will

  // pod is immediatedly created on that node without considering surge limits.
  // Allowing surge implies the possibility that the resources consumed by the
  // daemonset on any given node can double if the readiness check fails, and
  // so resource intensive daemonsets should take into account that they may
  // cause evictions during disruption.
  // +optional
  optional k8s.io.apimachinery.pkg.util.intstr.IntOrString maxSurge = 2;
}

}

// mustGetService returns the service with the given name or fails if it's not found in objs.
func mustGetService(g *WithT, objs *ObjectSet, name string) *object.K8sObject {
	obj := objs.kind(name2.ServiceStr).nameEquals(name)
	g.Expect(obj).Should(Not(BeNil()))
	return obj
}

// mustGetDeployment returns the deployment with the given name or fails if it's not found in objs.

    # shellcheck disable=SC2181
    if [[ $? == 0 ]]; then
      break
    fi
    if ! grep -Eq "${failureRegex}" "${tmpFile}"; then
      fail "Unexpected failure"
    fi
    if [[ $n -lt $max ]]; then
      ((n++))
      echo "Command failed. Attempt $n/$max:"
    else
      fail "The command has failed after $n attempts."
    fi
  done
}

  // Container will be restarted if the probe fails.
  // Cannot be updated.
  // More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
  // +optional
  optional Probe livenessProbe = 10;

  // Periodic probe of container service readiness.
  // Container will be removed from service endpoints if the probe fails.
  // Cannot be updated.

	deserializer := codecFactory.UniversalDeserializer()

	fail := admitv1.Fail
	fakeClient := kube.NewFakeClient(&admitv1.ValidatingWebhookConfiguration{
		TypeMeta: metav1.TypeMeta{},
		ObjectMeta: metav1.ObjectMeta{
			Name: "istiod-default-validator",
		},
		Webhooks: []admitv1.ValidatingWebhook{
			{
				Name: "random",
			},
			{
				FailurePolicy: &fail,
				Name:          "validation.istio.io",
			},
		},

	// once the pod restarts (in CrashLoopBackoff), which can take some time.
	// We don't want to constantly try to apply the iptables rules, which is unneeded and will fail.
	// Instead, we track which UIDs we repaired and skip them if already repaired.
	//
	// An alternative would be to write something to the Pod (status, annotation, etc).

      path: "{{ .injectionPath }}"
      port: 443
    {{- end }}
  sideEffects: None
  rules:
  - operations: [ "CREATE" ]
    apiGroups: [""]
    apiVersions: ["v1"]
    resources: ["pods"]
  failurePolicy: Fail
  admissionReviewVersions: ["v1beta1", "v1"]
{{- end }}
{{- range $tagName := $.Values.revisionTags }}
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:

{{- $res := tpl (print "{{" (repeat (split "." $dep | len) "(")  ".Values." (replace "." ")." $dep) ")}}") $}}
{{- if not (eq $res "")}}
{{fail (print $dep " is removed")}}
{{- end }}

			expectedString: "Error: expecting pod name",
			wantException:  true, // "istioctl experimental inspect pod" should fail
		},
		{ // case 3 unknown pod
			args:           strings.Split("po not-a-pod", " "),
			expectedString: "pods \"not-a-pod\" not found",
			wantException:  true, // "istioctl experimental describe pod not-a-pod" should fail
		},
		{ // case 8 unknown service
			args:           strings.Split("service not-a-service", " "),