if wh.ClientConfig.Service == nil {
				// it is an url, skip it
				continue
			}
			fname := resource.NewFullName(
				resource.Namespace(wh.ClientConfig.Service.Namespace),
				resource.LocalName(wh.ClientConfig.Service.Name))
			if !context.Exists(gvk.Service, fname) {
				context.Report(gvk.MutatingWebhookConfiguration, msg.NewInvalidWebhook(resources[fmt.Sprintf("%v/%v", name, wh.Name)],

	}
	return false
}

func getNamespaceLabels(c analysis.Context, nsName string) map[string]string {
	if nsName == "" {
		nsName = "default"
	}
	ns := c.Find(gvk.Namespace, resource.NewFullName("", resource.LocalName(nsName)))
	if ns == nil {
		return nil
	}
	return ns.Metadata.Labels
}

func matchesWebhooks(nsLabels, podLabels map[string]string, istioWebhooks []admitv1.MutatingWebhook) bool {

func getNamesSidecarInjectionStatus(ns resource.Namespace, c analysis.Context) (enabled bool, ok bool) {
	enabled, ok = false, false

	namespace := c.Find(gvk.Namespace, resource.NewFullName("", resource.LocalName(ns)))
	if namespace != nil {
		enabled, ok = namespace.Metadata.Labels[InjectionLabelName] == InjectionLabelEnableValue, true
	}

	return enabled, ok
}

		cfgs := store.List(colschema.GroupVersionKind(), "")
		broken := false
		for _, cfg := range cfgs {
			k := key{
				col, resource.FullName{
					Name:      resource.LocalName(cfg.Name),
					Namespace: resource.Namespace(cfg.Namespace),
				}, id,
			}
			if res, ok := i.found[k]; ok {
				if !broken && !fn(res) {
					broken = true
				}
				cache[k] = res
				continue

constexpr absl::string_view kMultiplePathsToChild = R"(
nodes {
  children {
    node_id: 1
    local_name: "foo"
  }
  children {
    node_id: 2
    local_name: "bar"
  }
  children {
    node_id: 3
    local_name: "signatures"
  }
  user_object {
    identifier: "_generic_user_object"
    version {
      producer: 1
      min_consumer: 1
    }

          mountPath: /dev/kmsg
          readOnly: true
        - name: localtime
          mountPath: /etc/localtime
          readOnly: true
      volumes:
      - name: log
        hostPath:
          path: /var/log/
      - name: kmsg
        hostPath:
          path: /dev/kmsg
      - name: localtime
        hostPath:
          path: /etc/localtime
          type: "FileOrCreate"

	localZoneName := "Local"
	// The file may not exist.
	if _, err := os.Stat("/etc/localtime"); os.IsNotExist(err) {
		localZoneName = "UTC"
	}

	cases := []struct {
		nilFlag bool
		tz      string
		local   string
	}{
		// no $TZ means use the system default /etc/localtime.
		{true, "", localZoneName},
		// $TZ="" means use UTC.
		{false, "", "UTC"},
		{false, ":", "UTC"},

	// no $TZ means use the system default /etc/localtime.
	// $TZ="" means use UTC.
	// $TZ="foo" or $TZ=":foo" if foo is an absolute path, then the file pointed
	// by foo will be used to initialize timezone; otherwise, file
	// /usr/share/zoneinfo/foo will be used.

	tz, ok := syscall.Getenv("TZ")
	switch {
	case !ok:
		z, err := loadLocation("localtime", []string{"/etc"})
		if err == nil {
			localLoc = *z

  for (const auto& trackable_child_ref : trackable_object->children()) {
    const auto& local_name = trackable_child_ref.local_name();

    // Compute the full child name.
    std::string child_name;
    if (object_name.empty()) {
      child_name = local_name;
    } else {
      child_name = strings::StrCat(object_name, ".", local_name);
    }

    // Descend down the trackable graph.

  && git config --system user.name "kube-build-image"

# Fix permissions on gopath
RUN chmod -R a+rwx $GOPATH

# Make log messages use the right timezone
ADD localtime /etc/localtime
RUN chmod a+r /etc/localtime

# Set up rsyncd
ADD rsyncd.password /
RUN chmod a+r /rsyncd.password
ADD rsyncd.sh /