func checkCmd(ctx cli.Context) *cobra.Command {
	cmd := &cobra.Command{
		Use:   "check [<type>/]<name>[.<namespace>]",
		Short: "Check AuthorizationPolicy applied in the pod.",
		Long: `Check prints the AuthorizationPolicy applied to a pod by directly checking
the Envoy configuration of the pod. The command is especially useful for inspecting
the policy propagation from Istiod to Envoy and the final AuthorizationPolicy list merged

               },
               "expr": "sum by (pod) (container_memory_working_set_bytes{container=\"discovery\",pod=~\"istiod-.*\"})",
               "legendFormat": "Container ({{pod}})"
            },
            {
               "datasource": {
                  "type": "prometheus",
                  "uid": "$datasource"
               },
               "expr": "sum by (pod) (go_memstats_stack_inuse_bytes{app=\"istiod\"})",

          sum(labels('container_memory_working_set_bytes', containerLabels), by=['pod'])
        ),
        self.query(
          'Stack ({{pod}})',
          sum(labels('go_memstats_stack_inuse_bytes', appLabels), by=['pod'])
        ),
        self.query(
          'Heap (In Use) ({{pod}})',
          sum(labels('go_memstats_heap_inuse_bytes', appLabels), by=['pod'])
        ),
        self.query(

	PodDeleted(ctx context.Context, uid string) error
	PodAdded(ctx context.Context, pod *v1.Pod, netns Netns) error
	Close() error
}

/*
To clean up stale ztunnels

	we may need to ztunnel to send its (uid, bootid / boot time) to us
	so that we can remove stale entries when the ztunnel pod is deleted
	or when the ztunnel pod is restarted in the same pod (remove old entries when the same uid connects again, but with different boot id?)

  private void setPredecessor(int entry, int pred) {
    long predMask = ~0L << 32;
    setLink(entry, (link(entry) & ~predMask) | ((long) (pred + 1) << 32));
  }

  private void setSucceeds(int pred, int succ) {
    if (pred == ENDPOINT) {
      firstEntry = succ;
    } else {
      setSuccessor(pred, succ);
    }

    if (succ == ENDPOINT) {
      lastEntry = pred;
    } else {

	podList, err := client.Pods(namespace).List(context.TODO(), options)
	if err != nil {
		return nil, err
	}
	pods := make([]*corev1.Pod, 0, len(podList.Items))
	for i := range podList.Items {
		pod := podList.Items[i]
		pods = append(pods, &pod)
	}
	if len(pods) > 0 {
		sort.Sort(sortBy(pods))
		return pods[0], nil
	}

    }
  });

  $("#searchOptionsClearButton").on("click", function(e) {
    $("#labelTypeSearchOption").prop("selectedIndex", -1);
    $("#langSearchOption").prop("selectedIndex", 0);
    $("#sortSearchOption").prop("selectedIndex", 0);
    $("#numSearchOption").prop("selectedIndex", 0);
    return false;
  });

  $result.on("mousedown", "a.link", function(e) {
    var docId = $(this).attr("data-id"),

      },
      "endpoints": {
        "Kubernetes//Pod/bookinfo/reviews-v2-5b667bcbf8-q5pn2:/10.244.1.38": {
          "workloadUid": "Kubernetes//Pod/bookinfo/reviews-v2-5b667bcbf8-q5pn2",
          "service": "bookinfo/reviews.bookinfo.svc.cluster.local",
          "address": "/10.244.1.38",
          "port": {
            "9080": 9080
          }
        },
        "Kubernetes//Pod/bookinfo/reviews-v1-5b5d6494f4-qwjv4:/10.244.1.37": {

  // in a pod.
  // The runtimeHandler must be lowercase, conform to the DNS Label (RFC 1123)
  // requirements, and is immutable.
  optional string runtimeHandler = 1;

  // overhead represents the resource overhead associated with running a pod for a
  // given RuntimeClass. For more details, see
  // https://git.k8s.io/enhancements/keps/sig-node/688-pod-overhead/README.md
  // +optional

  // +optional
  optional bool readOnly = 2;
}

// Eviction evicts a pod from its node subject to certain policies and safety constraints.
// This is a subresource of Pod.  A request to cause such an eviction is
// created by POSTing to .../pods/<pod name>/evictions.
message Eviction {
  // ObjectMeta describes the pod that is being evicted.
  // +optional