} else {
				assert.NoError(t, err)
			}
		})
	}
}

func Test_checkTracing(t *testing.T) {
	cli := kube.NewFakeClient()
	messages := diag.Messages{}

	zipkinSvc := &corev1.Service{
		ObjectMeta: metav1.ObjectMeta{
			Name:      "zipkin",
			Namespace: "istio-system",
		},
	}
	cli.Kube().CoreV1().Services("istio-system").Create(context.Background(), zipkinSvc, metav1.CreateOptions{})

	client := kube.NewFakeClient(ns, pod)

	// We are expecting at most 1 calls to the mock, wait for them
	wg, waitForMockCalls := NewWaitForNCalls(t, 1)
	fs := &fakeServer{testWG: wg}

	fs.On("AddPodToMesh",
		ctx,
		mock.IsType(pod),
		util.GetPodIPsIfPresent(pod),
		valid.Netns,
	).Return(nil)

	dpServer := getFakeDP(fs, client.Kube())

                {
                    "endpoint_config": {
                        "@type": "type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment",
                        "cluster_name": "outbound|53||kube-dns.kube-system.svc.cluster.local",
                        "endpoints": [
                            {
                                "locality": {},
                                "lb_endpoints": [

    * kubelet_volume_stats_inodes_used
    * plugin_manager_total_plugins
    * volume_manager_total_volumes
* kubeadm: enable the usage of the secure kube-scheduler and kube-controller-manager ports for health checks. For kube-scheduler was 10251, becomes 10259. For kube-controller-manager was 10252, becomes 10257. ([#85043](https://github.com/kubernetes/kubernetes/pull/85043), [@neolit123](https://github.com/neolit123))

          "service": "kube-system/kube-dns.kube-system.svc.cluster.local",
          "address": "/10.244.0.2",
          "port": {
            "53": 53,
            "9153": 9153
          }
        },
        "Kubernetes//Pod/kube-system/coredns-5dd5756b68-nzlpw:/10.244.0.3": {
          "workloadUid": "Kubernetes//Pod/kube-system/coredns-5dd5756b68-nzlpw",

	"istio.io/istio/pkg/config/constants"
	"istio.io/istio/pkg/config/host"
	configKube "istio.io/istio/pkg/config/kube"
	"istio.io/istio/pkg/config/mesh"
	protocolinstance "istio.io/istio/pkg/config/protocol"
	"istio.io/istio/pkg/kube"
	"istio.io/istio/pkg/kube/inject"
	"istio.io/istio/pkg/kube/labels"
	"istio.io/istio/pkg/log"
	"istio.io/istio/pkg/maps"
	"istio.io/istio/pkg/slices"
	"istio.io/istio/pkg/url"

      - [Other Notable Changes](#other-notable-changes-14)
    - [Node Components](#node-components-2)
      - [Bug fixes](#bug-fixes-1)
    - [kube-controller-manager](#kube-controller-manager)
    - [kube-dns](#kube-dns)
    - [kube-proxy](#kube-proxy)
    - [Scheduler](#scheduler)
    - [Volume Plugins](#volume-plugins)
      - [Azure Disk](#azure-disk)
      - [GlusterFS](#glusterfs)

	return multiErr.ErrorOrNil()
}

func labelNamespaceWithWaypoint(kubeClient kube.CLIClient, ns string) error {
	nsObj, err := getNamespace(kubeClient, ns)
	if err != nil {
		return err
	}
	if nsObj.Labels == nil {
		nsObj.Labels = map[string]string{}
	}
	nsObj.Labels[label.IoIstioUseWaypoint.Name] = waypointName

			if err != nil {
				return nil, err
			}
			curContext := rawConfig.Contexts[rawConfig.CurrentContext]
			if curContext == nil {
				continue
			}
			client, err := kube.NewCLIClient(clientConfig,
				kube.WithRevision(revisionSpecified),
				kube.WithCluster(cluster.ID(curContext.Cluster)))
			if err != nil {
				return nil, err
			}
			clients = append(clients, &Client{
				client: client,
				remote: true,

through the built-in NodeRestriction admission plugin.

**Affected Versions**:
  - kube-apiserver v1.20.0 - v1.20.5
  - kube-apiserver v1.19.0 - v1.19.9
  - kube-apiserver <= v1.18.17

**Fixed Versions**:
  - kube-apiserver v1.21.0
  - kube-apiserver v1.20.6
  - kube-apiserver v1.19.10
  - kube-apiserver v1.18.18

This vulnerability was reported by Rogerio Bastos & Ari Lima from RedHat