if err != nil {
					return fmt.Errorf("not able to locate pod with selector %s: %v", istiodLabelSelector, err)
				}

				if len(pl.Items) < 1 {
					return errors.New("no pods found")
				}

				if len(pl.Items) > 1 {
					log.Warnf("more than 1 pods fits selector: %s; will use pod: %s", istiodLabelSelector, pl.Items[0].Name)
				}

				// only use the first pod in the list

```yaml
apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: strict-and-permissive-mtls
spec:
  selector:
    matchLabels:
      app: a
  mtls:
    mode: STRICT
  portLevelMtls:
    9090:
      mode: PERMISSIVE
```

will be translated into this `Authorization`:

```yaml
action: DENY
groups:

### API Change

		Dest:                 stmt.Dest,
		ReflectValue:         stmt.ReflectValue,
		Clauses:              map[string]clause.Clause{},
		Distinct:             stmt.Distinct,
		Selects:              stmt.Selects,
		Omits:                stmt.Omits,
		ColumnMapping:        stmt.ColumnMapping,
		Preloads:             map[string][]interface{}{},
		ConnPool:             stmt.ConnPool,

      bearerTokenSecret:
        name: {{ template "minio.fullname" . }}-prometheus
        key: token
      {{- end }}
  namespaceSelector:
    matchNames:
      - {{ .Release.Namespace | quote }}
  selector:
    matchLabels:
      app: {{ include "minio.name" . }}
      release: {{ .Release.Name }}
      monitoring: "true"
{{- end }}
{{- if .Values.metrics.serviceMonitor.enabled }}
---

.Values.consoleService.nodePort }} {{- else }} targetPort: {{ .Values.consoleService.port }} {{- end}} {{- if .Values.consoleService.externalIPs }} externalIPs: {{- range $i , $ip := .Values.consoleService.externalIPs }} - {{ $ip }} {{- end }} {{- end }} selector: app: {{ template "minio.name" . }} release: {{ .Release.Name }} minio/templates/deployment.yaml {{- if eq .Values.mode "standalone" }} {{ $scheme := "http" }} {{- if .Values.tls.enabled }} {{ $scheme = "https" }} {{ end }} {{ $bucketRoot := or ...

.Values.consoleService.nodePort }} {{- else }} targetPort: {{ .Values.consoleService.port }} {{- end}} {{- if .Values.consoleService.externalIPs }} externalIPs: {{- range $i , $ip := .Values.consoleService.externalIPs }} - {{ $ip }} {{- end }} {{- end }} selector: app: {{ template "minio.name" . }} release: {{ .Release.Name }} minio/templates/deployment.yaml {{- if eq .Values.mode "standalone" }} {{ $scheme := "http" }} {{- if .Values.tls.enabled }} {{ $scheme = "https" }} {{ end }} {{ $bucketRoot := or ...

// RuntimeClass.
message Scheduling {
  // nodeSelector lists labels that must be present on nodes that support this
  // RuntimeClass. Pods using this RuntimeClass can only be scheduled to a
  // node matched by this selector. The RuntimeClass nodeSelector is merged
  // with a pod's existing nodeSelector. Any conflicts will cause the pod to
  // be rejected in admission.
  // +optional
  // +mapType=atomic
  map<string, string> nodeSelector = 1;

  - kube-proxy addon starts to use the label `node.kubernetes.io/kube-proxy-ds-ready` instead of `beta.kubernetes.io/kube-proxy-ds-ready` as its node selector.
  - metadata-proxy addon starts to use the label `cloud.google.com/metadata-proxy-ready` instead of `beta.kubernetes.io/metadata-proxy-ready` as its node selector.

#### Storage

		"XDS Endpoint")
	cmd.PersistentFlags().StringVar(&o.CertDir, "cert-dir", viper.GetString("CERT-DIR"),
		"XDS Endpoint certificate directory")
	cmd.PersistentFlags().StringVar(&o.XdsPodLabel, "xds-label", "",
		"Istiod pod label selector")
	cmd.PersistentFlags().IntVar(&o.XdsPodPort, "xds-port", viper.GetInt("XDS-PORT"),
		"Istiod pod port")
	cmd.PersistentFlags().DurationVar(&o.Timeout, "timeout", time.Second*30,
		"The duration to wait before failing")