// seats this priority level can borrow from other priority levels.
  // The limit is known as this level's BorrowingConcurrencyLimit
  // (BorrowingCL) and is a limit on the total number of seats that this
  // level may borrow at any one time.
  // This field holds the ratio of that limit to the level's nominal
  // concurrency limit. When this field is non-nil, it must hold a

	_, err = client.Kube().CoreV1().Namespaces().Patch(ctx, ns.Name,
		types.MergePatchType, labelsPatch, metav1.PatchOptions{})
	assert.NoError(t, err)

	// wait for another two update events
	// total 3 update at before unlabel point: 1. init ns reconcile 2. ns label reconcile 3. pod annotation update
	mt.Assert(EventTotals.Name(), map[string]string{"type": "update"}, monitortest.AtLeast(5))

	waitForMockCalls()

  // Defaults to false.
  // +optional
  optional bool readOnly = 6;

  // portals is the iSCSI Target Portal List. The Portal is either an IP or ip_addr:port if the port
  // is other than default (typically TCP ports 860 and 3260).
  // +optional
  repeated string portals = 7;

  // chapAuthDiscovery defines whether support iSCSI Discovery CHAP authentication
  // +optional

  // +optional
  optional int32 readyReplicas = 7;

  // Total number of available pods (ready for at least minReadySeconds) targeted by this deployment.
  // +optional
  optional int32 availableReplicas = 4;

  // Total number of unavailable pods targeted by this deployment. This is the total number of
  // pods that are still required for the deployment to have 100% available capacity. They may

        "options": [],
        "query": "query_result((sum(istio_requests_total{destination_workload_namespace=~\"$namespace\"}) by (destination_workload) or sum(istio_requests_total{source_workload_namespace=~\"$namespace\"}) by (source_workload)) or (sum(istio_tcp_sent_bytes_total{destination_workload_namespace=~\"$namespace\"}) by (destination_workload) or sum(istio_tcp_sent_bytes_total{source_workload_namespace=~\"$namespace\"}) by (source_workload)))",

  optional int64 observedGeneration = 1;

  // Total number of non-terminated pods targeted by this deployment (their labels match the selector).
  // +optional
  optional int32 replicas = 2;

  // Total number of non-terminated pods targeted by this deployment that have the desired template spec.
  // +optional
  optional int32 updatedReplicas = 3;

  // Total number of ready pods targeted by this deployment.
  // +optional

	metricsDuration time.Duration
)

const (
	destWorkloadLabel          = "destination_workload"
	destWorkloadNamespaceLabel = "destination_workload_namespace"
	reqTot                     = "istio_requests_total"
	reqDur                     = "istio_request_duration_milliseconds"
)

func Cmd(ctx cli.Context) *cobra.Command {
	cmd := &cobra.Command{
		Use:   "metrics <workload name>...",

    # `updateStrategy.rollingUpdate.maxUnavailable` here:
    # https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
    # May be specified as a number of pods or as a percent of the total number
    # of pods at the start of the update.
    rollingMaxUnavailable: 1

  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
  revision: ""

	resultLabel   = monitoring.CreateLabel("result")
	resultSuccess = "success"
	resultSkip    = "skip"
	resultFail    = "fail"

	podsRepaired = monitoring.NewSum(
		"istio_cni_repair_pods_repaired_total",
		"Total number of pods repaired by repair controller",
	)

  // +optional
  optional int32 readyReplicas = 7;

  // Total number of available pods (ready for at least minReadySeconds) targeted by this deployment.
  // +optional
  optional int32 availableReplicas = 4;

  // unavailableReplicas is the total number of unavailable pods targeted by this deployment. This is the total number of