if len(args) > 0 {
				podName, ns, err := ctx.InferPodInfoFromTypedResource(args[0], ctx.Namespace())
				if err != nil {
					return err
				}
				if ambient.IsZtunnelPod(kubeClient, podName, ns) {
					_, _ = fmt.Fprintf(c.OutOrStdout(),
						"Sync diff is not available for ztunnel pod %s.%s\n", podName, ns)
					return nil
				}
				var envoyDump []byte

	p.mu.Lock()
	defer p.mu.Unlock()
	if ns, ok := p.currentPodCache[uid]; ok {
		delete(p.currentPodCache, uid)
		// already in cache
		return ns.Netns
	}

	return nil
}

func openNetnsInRoot(hostMountsPath string) func(nspath string) (NetnsCloser, error) {
	return func(nspath string) (NetnsCloser, error) {
		nspathInContainer := filepath.Join(hostMountsPath, nspath)
		ns, err := OpenNetns(nspathInContainer)

package plugin

import (
	"fmt"

	"github.com/containernetworking/plugins/pkg/ns"

	"istio.io/istio/pkg/log"
	"istio.io/istio/tools/istio-iptables/pkg/cmd"
	"istio.io/istio/tools/istio-iptables/pkg/config"
	"istio.io/istio/tools/istio-iptables/pkg/dependencies"
)

// getNs is a unit test override variable for interface create.
var getNs = ns.GetNS

// Program defines a method which programs iptables based on the parameters

		constants.DataplaneModeLabel))
	_, err = client.Kube().CoreV1().Namespaces().Patch(ctx, ns.Name,
		types.MergePatchType, labelsPatch, metav1.PatchOptions{})
	assert.NoError(t, err)

	// wait for another two update events
	// total 3 update at before unlabel point: 1. init ns reconcile 2. ns label reconcile 3. pod annotation update

		LabelSelector: fmt.Sprintf("%s=%s", label.IoIstioRev.Name, tag),
	})
	if err != nil {
		return nil, err
	}

	nsNames := make([]string, len(namespaces.Items))
	for i, ns := range namespaces.Items {
		nsNames[i] = ns.Name
	}
	return nsNames, nil
}

// GetWebhookTagName extracts tag name from webhook object.
func GetWebhookTagName(wh admitv1.MutatingWebhookConfiguration) string {

	ctx := context.Background()
	nsList, err := getNamespaces(ctx, kubeClient)
	if err != nil {
		return nil, err
	}

	var nsNameList []string
	for _, ns := range nsList {
		if toComplete == "" || strings.HasPrefix(ns.Name, toComplete) {
			nsNameList = append(nsNameList, ns.Name)
		}
	}

	return nsNameList, nil
}

func getNamespaces(ctx context.Context, client kube.CLIClient) ([]corev1.Namespace, error) {

spiffe://cluster.local/ns/istio-system/sa/istiod         Leaf     Available        true           e5dfb59150b2ba7f108d93dcec5aa613     2033-03-22T13:04:57Z     2023-03-21T13:02:57Z
spiffe://cluster.local/ns/istio-system/sa/istiod         Root     Available        false          8a516645c40ce76c2c0d27ab4e2461c1     2022-03-18T13:04:49Z     2022-03-21T13:04:49Z

// limitations under the License.

package nodeagent

import (
	"fmt"
	"runtime"
	"sync"

	netns "github.com/containernetworking/plugins/pkg/ns"
	"golang.org/x/sys/unix"
)

type NetnsWrapper struct {
	innerNetns netns.NetNS
	inode      uint64
}

func (n *NetnsWrapper) Inode() uint64 {
	return n.inode
}

				// only use the first pod in the list
				podName = pl.Items[0].Name
				ns = pl.Items[0].Namespace
			} else {
				podName, ns, err = ctx.InferPodInfoFromTypedResource(args[0], ctx.IstioNamespace())
				if err != nil {
					return err
				}
			}
			port := inferMonitoringPort(client, podName, ns)
			return portForward(podName, ns, fmt.Sprintf("Istio debug %s", podName),

				if err != nil {
					return err
				}
				ns, err := kubeClient.Kube().CoreV1().Namespaces().Get(context.TODO(), podNs, metav1.GetOptions{})
				if err != nil {
					return err
				}
				podLabels = pod.GetLabels()
				nsLabels = ns.GetLabels()
			} else {
				namespace := ctx.NamespaceOrDefault(ctx.Namespace())