retry.UntilSuccessOrFail(t, func() error {
		pods, err := cluster.Kube().CoreV1().Pods(ns.Name()).List(context.TODO(), metav1.ListOptions{})
		if err != nil {
			return err
		}
		if len(pods.Items) == 0 {
			return fmt.Errorf("still waiting the pod in namespace %v to start", ns.Name())
		}
		// Verify that at least one pod is in broken state due to the race condition.
		for _, p := range pods.Items {

	// are satisfied and the number of active Pods matches expectations (i.e. no
	// pod creation/deletions issued in this sync). This is expected to be the
	// action in most of the syncs.
	JobSyncActionTracking = "tracking"
	// JobSyncActionPodsCreated when the controller creates Pods. This can happen
	// when the number of active Pods is less than the wanted Job parallelism.
	JobSyncActionPodsCreated = "pods_created"

// in either include or excluded list.
var included = []schema.GroupResource{
	{Group: "", Resource: "bindings"},
	{Group: "", Resource: "pods/attach"},
	{Group: "", Resource: "pods/binding"},
	{Group: "", Resource: "pods/eviction"},
	{Group: "", Resource: "pods/exec"},
	{Group: "", Resource: "pods/portforward"},

	// ref: https://github.com/kubernetes/kubernetes/issues/122205#issuecomment-1927390823

	mockCtrl := gomock.NewController(t)
	defer mockCtrl.Finish()

	for _, tc := range []struct {
		desc             string
		pods             []*v1.Pod
		devices          []*podresourcesv1.ContainerDevices
		expectedResponse *v1alpha1.ListPodResourcesResponse
	}{
		{
			desc:             "no pods",
			pods:             []*v1.Pod{},
			devices:          []*podresourcesv1.ContainerDevices{},

	assert.Equal(t, exp, got)

	got = kubelet.getPodVolumeDeviceDir("abc123", "plugin")
	exp = filepath.Join(root, "pods/abc123/volumeDevices/plugin")
	assert.Equal(t, exp, got)

	got = kubelet.getPodPluginsDir("abc123")
	exp = filepath.Join(root, "pods/abc123/plugins")
	assert.Equal(t, exp, got)

	got = kubelet.getPodPluginDir("abc123", "foobar")

			podKey: podKey(testPodWithEphemeral),
		},
		{
			name: "pod-deleted",
			pods: func() []*v1.Pod {
				deleted := metav1.Now()
				pods := []*v1.Pod{testPodWithEphemeral.DeepCopy()}
				pods[0].DeletionTimestamp = &deleted
				return pods
			}(),
			podKey: podKey(testPodWithEphemeral),
		},
		{
			name:   "no-volumes",
			pods:   []*v1.Pod{testPod},
			podKey: podKey(testPod),
		},
		{

	}

	options := metav1.ListOptions{LabelSelector: selector}
	podList, err := client.Pods(namespace).List(context.TODO(), options)
	if err != nil {
		return []string{}, "", err
	}
	pods := []string{}
	for i := range podList.Items {
		pods = append(pods, podList.Items[i].Name)
	}

	return pods, namespace, nil
}

	}
	c.pods = kclient.New[*v1.Pod](cl)
	c.services = kclient.New[*v1.Service](cl)
	c.queue = controllers.NewQueue("pods", controllers.WithReconciler(c.Reconcile))
	c.pods.AddEventHandler(controllers.ObjectHandler(c.queue.AddObject))
	c.services.AddEventHandler(controllers.FromEventHandler(func(e controllers.Event) {
		o := e.Latest()

func AnnotateEnrolledPod(client kubernetes.Interface, pod *metav1.ObjectMeta) error {
	_, err := client.CoreV1().
		Pods(pod.Namespace).
		Patch(
			context.Background(),
			pod.Name,
			types.MergePatchType,
			annotationPatch,
			metav1.PatchOptions{},
			// Both "pods" and "pods/status" can mutate the metadata. However, pods/status is lower privilege, so we use that instead.
			"status",
		)
	return err
}

{{- if .Values.cni.resourceQuotas.enabled }}
apiVersion: v1
kind: ResourceQuota
metadata:
  name: {{ template "name" . }}-resource-quota
  namespace: {{ .Release.Namespace }}
spec:
  hard:
    pods: {{ .Values.cni.resourceQuotas.pods | quote }}
  scopeSelector:
    matchExpressions:
    - operator: In
      scopeName: PriorityClass
      values:
      - system-node-critical