//   * increase no more than 4 pods per 60 seconds
  //   * double the number of pods per 60 seconds
  // No stabilization is used.
  // +optional
  optional HPAScalingRules scaleUp = 1;

  // scaleDown is scaling policy for scaling Down.
  // If not set, the default value is to allow to scale down to minReplicas pods, with a
  // 300 second stabilization window (i.e., the highest recommendation for

message Scheduling {
  // nodeSelector lists labels that must be present on nodes that support this
  // RuntimeClass. Pods using this RuntimeClass can only be scheduled to a
  // node matched by this selector. The RuntimeClass nodeSelector is merged
  // with a pod's existing nodeSelector. Any conflicts will cause the pod to
  // be rejected in admission.
  // +optional
  // +mapType=atomic
  map<string, string> nodeSelector = 1;

  // An empty podSelector matches all pods in this namespace.
  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector podSelector = 1;

  // ingress is a list of ingress rules to be applied to the selected pods.
  // Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod
  // (and cluster policy otherwise allows the traffic), OR if the traffic source is

// an actual pod condition type.
message PodFailurePolicyOnPodConditionsPattern {
  // Specifies the required Pod condition type. To match a pod condition
  // it is required that specified type equals the pod condition type.
  optional string type = 1;

  // Specifies the required Pod condition status. To match a pod condition

func PodRedirectionActive(pod *corev1.Pod) bool {
	return pod.GetAnnotations()[annotation.AmbientRedirection.Name] == constants.AmbientRedirectionEnabled
}

func podHasSidecar(pod *corev1.Pod) bool {
	if _, f := pod.GetAnnotations()[annotation.SidecarStatus.Name]; f {
		return true
	}
	return false
}

func IsZtunnelPod(systemNs string, pod *corev1.Pod) bool {

  // all pods within the namespace.
  // +patchStrategy=replace
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 2;

  // An eviction is allowed if at most "maxUnavailable" pods selected by
  // "selector" are unavailable after the eviction, i.e. even in absence of
  // the evicted pod. For example, one can prevent all voluntary evictions

  // resource metric across all relevant pods, represented as a percentage of
  // the requested value of the resource for the pods.
  // +optional
  optional int32 targetAverageUtilization = 2;

  // targetAverageValue is the target value of the average of the
  // resource metric across all relevant pods, as a raw value (instead of as
  // a percentage of the request), similar to the "pods" metric source type.
  // +optional

	retval := map[resource.Namespace][]corev1.Pod{}
	// All pods in all namespaces
	pods, err := client.Kube().CoreV1().Pods("").List(ctx, metav1.ListOptions{})
	if err != nil {
		return retval, err
	}
	for _, pod := range pods.Items {
		retval[resource.Namespace(pod.GetNamespace())] = append(retval[resource.Namespace(pod.GetNamespace())], pod)
	}
	return retval, nil
}

			matchingPods := make([]corev1.Pod, 0)
			var selectedPodCount int
			if len(labels) > 0 {
				pods, err := client.Kube().CoreV1().Pods(ns).List(context.TODO(), metav1.ListOptions{
					LabelSelector: strings.Join(labels, ","),
				})
				if err != nil {
					return err
				}
				selectedPodCount = len(pods.Items)
				for _, pod := range pods.Items {
					if pod.Status.Phase != corev1.PodRunning {

    reinvocationPolicy: Never
    rules:
      - apiGroups:
          - ""
        apiVersions:
          - v1
        operations:
          - CREATE
        resources:
          - pods
        scope: '*'
    sideEffects: None
    timeoutSeconds: 10
  - admissionReviewVersions:
      - v1beta1
      - v1
    clientConfig:
      service:
        name: istiod
        namespace: istio-system