type StateData interface {
	// Clone is an interface to make a copy of StateData. For performance reasons,
	// clone should make shallow copies for members (e.g., slices or maps) that are not
	// impacted by PreFilter's optional AddPod/RemovePod methods.
	Clone() StateData
}

// StateKey is the type of keys stored in CycleState.
type StateKey string

	Constraints(required []corev1.ResourceName, item runtime.Object) error
	// GroupResource returns the groupResource that this object knows how to evaluate
	GroupResource() schema.GroupResource
	// Handles determines if quota could be impacted by the specified attribute.
	// If true, admission control must perform quota processing for the operation, otherwise it is safe to ignore quota.
	Handles(operation admission.Attributes) bool

Next, for an individual proxy we will check if it could possibly be impacted by the change. For example, we know a sidecar never is impacted by a `Gateway` update, and we can also look at scoping (from `Sidecar.egress.hosts`) to further restrict update scopes.

        result.getLockedDependencies() == [newId(DefaultModuleIdentifier.newId('com', 'foo'), '1.0')] as Set

        where:
        unique << [true, false]
    }

    def 'can filter lock entries impacted by dependency substitutions (Unique: #unique)'() {
        given:
        dependencySubstitutionRules.rulesMayAddProjectDependency() >> true
        Action< DependencySubstitution> substitutionAction = Mock()

)

type preFilterState []*v1.ContainerPort

// Clone the prefilter state.
func (s preFilterState) Clone() framework.StateData {
	// The state is not impacted by adding/removing existing pods, hence we don't need to make a deep copy.
	return s
}

// Name returns name of the plugin. It is used in logs, etc.
func (pl *NodePorts) Name() string {
	return Name
}

					},
				},
				// Mutual TLS origination from an authorized sidecar to https endpoint with a CRL with a dummy revoked certificate.
				// Since the certificate in action is not revoked, the communication should not be impacted.
				{
					name:             "dummy crl",
					credentialToUse:  credWithDummyCRL,
					from:             apps.Ns2.B,
					drSelector:       "b",
					authorizeSidecar: true,

                .build());
        options.addOption(Option.builder(FAIL_AT_END)
                .longOpt("fail-at-end")
                .desc("Only fail the build afterwards; allow all non-impacted builds to continue")
                .build());
        options.addOption(Option.builder(FAIL_NEVER)
                .longOpt("fail-never")
                .desc("NEVER fail the build, regardless of project result")

				},
				// Set up an UpstreamCluster with a CredentialName where the secret has a CRL specified with an unused server certificate as revoked.
				// Since the certificate in action is not revoked, the communication should not be impacted.
				{
					name:            "credential with CRL having unused revoked server certificate",
					statusCode:      http.StatusOK,
					credentialToUse: credWithDummyCRL,
					useGateway:      true,
				},
			}

	// Now we should be able to look up a VIP as well
	s.assertWorkloads(t, s.addrXdsName("10.0.0.1"), workloadapi.WorkloadStatus_HEALTHY, "name1", "name2")
	// We should get an event for the two WEs and the selecting service impacted
	s.assertEvent(t, s.wleXdsName("name1"), s.wleXdsName("name2"), s.svcXdsName("svc1"))

	// Add a new pod to the service, we should see it
	s.addWorkloadEntries(t, "127.0.0.4", "name4", "sa4", map[string]string{"app": "a"})

func BenchmarkListenerGeneration(b *testing.B) {
	runBenchmark(b, v3.ListenerType, testCases)
}

func TestListenerGeneration(t *testing.T) {
	testBenchmark(t, v3.ListenerType, testCases)
}

// NDS isn't really impacted by anything beyond number of services, so just run these separately
var ndsCases = []ConfigInput{
	{
		Name:     "tcp",
		Services: 1000,
	},
}

func BenchmarkNameTableGeneration(b *testing.B) {