wantException:  true,
		},
		{ // supplying type that doesn't select pods should fail
			args:           strings.Split("listeners serviceaccount/sleep", " "),
			expectedString: `"serviceaccount/sleep" does not refer to a pod`,
			wantException:  true,
		},
		{ // supplying valid pod name retrieves Envoy config (fails because we don't check in Envoy config unit tests)

// sure the netns is closed eventually.
func assertNSClosed(t *testing.T, closed *atomic.Bool) {
	for i := 0; i < 5; i++ {
		if closed.Load() {
			return
		}
		time.Sleep(1 * time.Second)
	}
	t.Fatal("NS not closed")

                                    "tlsMode": "istio"
                                },
                                "istio": {
                                    "workload": "sleep;default;sleep;latest;Kubernetes"
                                }
                            }
                        },
                        "loadBalancingWeight": 1
                    }
                ],

                          "filter_state": {
                           "key": "io.istio.peer_principal",
                           "string_match": {
                            "exact": "spiffe://cluster.local/ns/default/sa/sleep"
                           }
                          }
                         }
                        ]
                       }
                      },
                      {

		pi, k8sErr = getK8sPodInfo(kClient, podName, podNamespace)
		if k8sErr == nil {
			break
		}
		log.Debugf("Failed to get %s/%s pod info: %v", podNamespace, podName, k8sErr)
		time.Sleep(podRetrievalInterval)
	}
	if k8sErr != nil {
		log.Errorf("Failed to get %s/%s pod info: %v", podNamespace, podName, k8sErr)
		return k8sErr
	}

                                        "name": "inbound-vip|80||sleep.default.svc.cluster.local-http",
                                        "typed_config": {
                                          "@type": "type.googleapis.com/google.protobuf.StringValue",
                                          "value": "inbound-vip|80||sleep.default.svc.cluster.local-http"
                                        }

		if err != nil {
			return err
		}
		log.Warnf("got an event for pod %s in namespace %s not found in current pod cache, retry %d of %d",
			addCmd.PodName, addCmd.PodNamespace, retries, maxStaleRetries)
		time.Sleep(time.Duration(msInterval) * time.Millisecond)
	}

	if ambientPod == nil {
		return fmt.Errorf("got event for pod %s in namespace %s but could not find in pod cache after retries", addCmd.PodName, addCmd.PodNamespace)
	}

                                            "filter_metadata": {
                                                "istio": {
                                                    "workload": "sleep;default;sleep;latest;Kubernetes"
                                                },
                                                "envoy.transport_socket_match": {