})
			filteredGws := make([]gateway.Gateway, 0)
			for _, gw := range gws.Items {
				if gw.Spec.GatewayClassName != constants.WaypointGatewayClassName {
					continue
				}
				filteredGws = append(filteredGws, gw)
			}
			if allNamespaces {
				fmt.Fprintln(w, "NAMESPACE\tNAME\tREVISION\tPROGRAMMED")
			} else {
				fmt.Fprintln(w, "NAME\tREVISION\tPROGRAMMED")
			}
			for _, gw := range filteredGws {

		repairedPods: map[types.NamespacedName]types.UID{},
	}
	fieldSelectors := []string{}
	if cfg.FieldSelectors != "" {
		fieldSelectors = append(fieldSelectors, cfg.FieldSelectors)
	}
	// filter out pod events from different nodes
	fieldSelectors = append(fieldSelectors, fmt.Sprintf("spec.nodeName=%v", cfg.NodeName))
	c.pods = kclient.NewFiltered[*corev1.Pod](client, kclient.Filter{
		LabelSelector: cfg.LabelSelectors,

		tagLabel := hook.GetLabels()[IstioTagLabel]
		ri, revPresent := revisions[rev]
		if revPresent {
			if tagLabel != "" {
				ri.Webhooks = append(ri.Webhooks, &MutatingWebhookConfigInfo{
					Name:     hook.Name,
					Revision: rev,
					Tag:      tagLabel,
				})
			}
		} else {
			revisions[rev] = &RevisionDescription{

	webhooks, err := GetWebhooksWithTag(ctx, client, tag)
	if err != nil {
		return err
	}
	var result error
	for _, wh := range webhooks {
		result = multierror.Append(result, client.AdmissionregistrationV1().MutatingWebhookConfigurations().Delete(ctx, wh.Name, metav1.DeleteOptions{})).ErrorOrNil()
	}
	return result
}

  //  2. If it's a kubelet serving certificate, it is assigned
  //     "kubernetes.io/kubelet-serving".
  //  3. Otherwise, it is assigned "kubernetes.io/legacy-unknown".
  // Distribution of trust for signers happens out of band.
  // You can select on this field using `spec.signerName`.
  // +optional
  optional string signerName = 7;

  // expirationSeconds is the requested duration of validity of the issued

  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - description: 'CreationTimestamp is a timestamp representing the server time
        when this object was created. It is not guaranteed to be set in happens-before
        order across separate operations. Clients may not set this value. It is represented
        in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for

    {{- end }}
  {{- end }}
{{- end }}
{{- $containers := list }}
{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
metadata:
  labels:
    {{/* security.istio.io/tlsMode: istio must be set by user, if gRPC is using mTLS initialization code. We can't set it automatically. */}}

		return err
	}
	relevantMessages := diag.Messages{}
	for _, msg := range res.Messages.FilterOutLowerThan(diag.Error) {
		if msg.Resource.Metadata.FullName.Name == resource.LocalName(name) {
			relevantMessages = append(relevantMessages, msg)
		}
	}
	if len(relevantMessages) > 0 {
		o, err := formatting.Print(relevantMessages, formatting.LogFormat, false)
		if err != nil {
			return err
		}
		// nolint

  // WhenDeleted specifies what happens to PVCs created from StatefulSet
  // VolumeClaimTemplates when the StatefulSet is deleted. The default policy
  // of `Retain` causes PVCs to not be affected by StatefulSet deletion. The
  // `Delete` policy causes those PVCs to be deleted.
  optional string whenDeleted = 1;

  // WhenScaled specifies what happens to PVCs created from StatefulSet

                          "allow_connect": true
                        },
                        "server_name": "istio-envoy",
                        "forward_client_cert_details": "APPEND_FORWARD",
                        "set_current_client_cert_details": {
                          "subject": true,
                          "dns": true,
                          "uri": true
                        },