istio-system       ztunnel-xljhg                                        10.244.1.44 ambient-worker        None                                TCP
kube-system        coredns-5dd5756b68-mgjn9                             10.244.0.2  ambient-control-plane None                                TCP
kube-system        coredns-5dd5756b68-nzlpw                             10.244.0.3  ambient-control-plane None                                TCP

	"istio.io/istio/pkg/config/schema/gvr"
	"istio.io/istio/pkg/kube"
	"istio.io/istio/pkg/kube/multicluster"
	"istio.io/istio/pkg/test"
	"istio.io/istio/pkg/test/env"
	"istio.io/istio/pkg/test/util/assert"
)

var (
	kubeSystemNamespaceUID = types.UID("54643f96-eca0-11e9-bb97-42010a80000a")
	kubeSystemNamespace    = &v1.Namespace{
		ObjectMeta: metav1.ObjectMeta{
			Name: "kube-system",
			UID:  kubeSystemNamespaceUID,
		},
	}
)

- kube-proxy no longer automatically cleans up network rules created by running kube-proxy in other modes. If you are switching the kube-proxy mode (EG: iptables to IPVS), you will need to run `kube-proxy --cleanup`, or restart the worker node (recommended) before restarting kube-proxy. If you are not switching kube-proxy between different modes, this change should not require any action. ([#76109](https://...

// +protobuf.options.(gogoproto.goproto_stringer)=false
message ExtraValue {
  // items, if empty, will result in an empty slice

  repeated string items = 1;
}

// SelfSubjectReview contains the user information that the kube-apiserver has about the user making this request.
// When using impersonation, users will receive the user info of the user being impersonated.  If impersonation or

Before upgrading to Kubernetes 1.13, you must keep the following in mind:

- kube-apiserver

	conf, err := parseConfig(args.StdinData)
	if err != nil {
		t.Fatalf("config parse failed with error: %v", err)
	}

	// Create a kube client
	client := kube.NewFakeClient(objects...)

	mockRedir := &mockInterceptRuleMgr{}
	err = doAddRun(args, conf, client.Kube(), mockRedir)
	if err == nil {
		t.Fatal("expected to fail, but did not!")
	}

	return mockRedir
}

* If you use one of the kube-dns replication controller manifest in `cluster/saltbase/salt/kube-dns`, i.e. `cluster/saltbase/salt/kube-dns/{skydns-rc.yaml.base,skydns-rc.yaml.in}`, either substitute one of `__PILLAR__FEDERATIONS__DOMAIN__MAP__` or `{{ pillar['federations_domain_map'] }}` with the corresponding federation name to...

# Intellij
*.iml
.idea/
.run/
# Visual Studio Code
.vscode/
# Bazel
/bazel-*
# vi swap files
.*.swp
# vi backups
*.bak
# common backups
*~
# python artifacts
*.pyc
# pilot
pilot/pkg/kube/config
pilot/pkg/proxy/envoy/envoy
# lint
lintconfig.gen.json
.istiorc
.istiorc.mk
# codegen stuff
bin/adapterlinter
bin/protoc-gen-gogoslick*
bin/protoc-min-version*
bin/protoc-gen-docs*
bin/testlinter

			wantNamespace: "istio-system",
		},
		{
			proxyName:     "istio-ingressgateway-8d9697654-qdzgh",
			namespace:     "kube-system",
			wantPodName:   "istio-ingressgateway-8d9697654-qdzgh",
			wantNamespace: "kube-system",
		},
		{
			proxyName:     "istio-security-post-install-1.2.2-bm9w2.istio-system",
			namespace:     "istio-system",
			wantPodName:   "istio-security-post-install-1.2.2-bm9w2",

	corev1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/client-go/kubernetes/fake"

	"istio.io/api/label"
	"istio.io/istio/istioctl/pkg/util"
	"istio.io/istio/pkg/kube"
)

func TestTagList(t *testing.T) {
	tcs := []struct {
		name          string
		webhooks      admitv1.MutatingWebhookConfigurationList
		namespaces    corev1.NamespaceList
		outputMatches []string