# Validate all yaml files under samples/bookinfo/networking directory
  istioctl validate -f samples/bookinfo/networking

  # Validate current deployments under 'default' namespace within the cluster
  kubectl get deployments -o yaml | istioctl validate -f -

  # Validate current services under 'default' namespace within the cluster
  kubectl get services -o yaml | istioctl validate -f -

			want: `
apiVersion: apps/v1
kind: Deployment
metadata:
  name: istio-citadel
  namespace: istio-system
a:
  b:
  - name: "n1"
    value: v2
  - list:
    - v1
    - v2
    - v3_regex
    name: n2
  c:
`,
		},
		{
			desc:  "ModifyListEntry",
			path:  `a.b.[name:n2].list.[v2]`,
			value: `v3`,
			want: `
apiVersion: apps/v1
kind: Deployment
metadata:
  name: istio-citadel

    # . implies these objects are visible to only to sidecars in the same namespace, or if imported as a Sidecar.egress.host
    defaultConfigVisibilitySettings: []

    # Default node selector to be applied to all deployments so that all pods can be
    # constrained to run a particular nodes. Each component can overwrite these default
    # values by adding its node selector block in the relevant section below and setting
    # the desired values.

          value: REDIRECT
        - name: ISTIO_META_WORKLOAD_NAME
          value: {{.DeploymentName}}
        - name: ISTIO_META_OWNER
          value: kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}
        {{- if .Values.global.meshID }}
        - name: ISTIO_META_MESH_ID
          value: "{{ .Values.global.meshID }}"

    code: IST0116
    level: Warning
    description: "The resulting pods of a service mesh deployment can't be associated with multiple services using the same port but different protocols."
    template: "This deployment %s is associated with multiple services using port %d but different protocols: %v"
    args:
      - name: deployment
        type: string
      - name: port
        type: int32
      - name: services

			a: `apiVersion: autoscaling/v2
kind: Deployment
metadata:
  annotations:
    checksum/config-volume: 43d72e930ed33e3e01731f8bcbf31dbf02cb1c1fc53bcc09199ab45c0d031b60
  name: istio-ingressgateway
  namespace: istio-system
  labels:
    app: istio-ingressgateway
    release: istio`,
			b: `apiVersion: autoscaling/v2
kind: Deployment
metadata:
  annotations:

			TerminationGracePeriodSeconds: &period,
			SchedulerName:                 v1.DefaultSchedulerName,
		},
	}
	tests := []struct {
		original *appsv1beta1.Deployment
		expected *appsv1beta1.Deployment
	}{
		{
			original: &appsv1beta1.Deployment{},
			expected: &appsv1beta1.Deployment{
				Spec: appsv1beta1.DeploymentSpec{
					Replicas: ptr.To[int32](1),
					Strategy: appsv1beta1.DeploymentStrategy{

  - apiGroups:
    - ""
    resources:
    - serviceaccounts/token
    verbs:
    - create
  - apiGroups:
    - apps
    resources:
    - daemonsets
    - deployments
    - deployments/rollback
    - deployments/scale
    - replicasets
    - replicasets/scale
    - statefulsets
    - statefulsets/scale
    verbs:
    - create
    - delete
    - deletecollection
    - patch

      "name": "ratings-v1-6484c4d9bb-mdxm5",
      "namespace": "bookinfo",
      "trustDomain": "cluster.local",
      "serviceAccount": "bookinfo-ratings",
      "workloadName": "ratings-v1",
      "workloadType": "deployment",
      "canonicalName": "ratings",
      "canonicalRevision": "v1",
      "network": "network1",
      "node": "ambient-worker2",
      "nativeTunnel": true,
      "status": "Healthy",

		maxUnavailable := intstr.FromInt32(2)
		deployment := newDeployment("foo", 10, nil, &maxSurge, &maxUnavailable, nil)
		fakeClientset := fake.Clientset{}

		controller := &DeploymentController{
			client:        &fakeClientset,
			eventRecorder: &record.FakeRecorder{},
		}
		_, ctx := ktesting.NewTestContext(t)
		_, cleanupCount, err := controller.cleanupUnhealthyReplicas(ctx, oldRSs, deployment, int32(test.maxCleanupCount))