retry.UntilSuccessOrFail(t, func() error {
					pods, err := podFetchFn()
					if err != nil {
						return fmt.Errorf("failed to get CNI pods %v", err)
					}
					if len(pods) == 0 {
						return fmt.Errorf("cannot find any CNI pods")
					}
					for _, p := range pods {
						if !strings.Contains(p.Spec.Containers[0].Image, v) {
							return fmt.Errorf("pods image does not match wanted CNI version")
						}
					}

)

// waitingPodsMap a thread-safe map used to maintain pods waiting in the permit phase.
type waitingPodsMap struct {
	pods map[types.UID]*waitingPod
	mu   sync.RWMutex
}

// NewWaitingPodsMap returns a new waitingPodsMap.
func NewWaitingPodsMap() *waitingPodsMap {
	return &waitingPodsMap{
		pods: make(map[types.UID]*waitingPod),
	}
}

// add a new WaitingPod to the map.

			},
			Node: pod.Spec.NodeName,
		}}
	})
	return &ClusterNodeAuthorizer{
		pods:                pods,
		nodeIndex:           index,
		trustedNodeAccounts: trustedNodeAccounts,
	}
}

func (na *ClusterNodeAuthorizer) Close() {
	na.pods.ShutdownHandlers()
}

func (na *ClusterNodeAuthorizer) HasSynced() bool {
	return na.pods.HasSynced()
}

// PodGCController, that runs in the controller manager. If the number of pods
// in terminated phases (right now either Failed or Succeeded) surpasses a
// configurable threshold, the controller will delete pods in terminated state
// until the system reaches the allowed threshold again. The PodGCController
// prioritizes pods to delete by sorting by creation timestamp and deleting the

type nodeGetter interface {
	// Get retrieves the Node for a given name.
	Get(name string) (*v1.Node, error)
}

// basicMirrorClient is a functional MirrorClient.  Mirror pods are stored in
// the kubelet directly because they need to be in sync with the internal
// pods.
type basicMirrorClient struct {
	apiserverClient clientset.Interface
	nodeGetter      nodeGetter
	nodeName        string
}

    new Kubernetes features. Previously, the webhook was triggered at a coarse grain level, selecting any
    pods in a namespace with a matching `istio-injection=enabled` label.

    This has two limitations:

    * Opting out individual pods with the `sidecar.istio.io/inject` label would still trigger the webhook,

	return b
}

// WithPods sets the Pods field in the declarative configuration to the given value
// and returns the receiver, so that objects can be built by chaining "With" function invocations.
// If called multiple times, the Pods field is set to the value of the last call.
func (b *MetricSpecApplyConfiguration) WithPods(value *PodsMetricSourceApplyConfiguration) *MetricSpecApplyConfiguration {
	b.Pods = value
	return b
}

            - "false"
    reinvocationPolicy: Never
    rules:
      - apiGroups:
          - ""
        apiVersions:
          - v1
        operations:
          - CREATE
        resources:
          - pods
        scope: '*'
    sideEffects: None
    timeoutSeconds: 10
  - admissionReviewVersions:
      - v1beta1
      - v1
    clientConfig:
      service:
        name: istiod
        namespace: istio-system

	k string
	v string
}

// MakeNodesAndPodsForEvenPodsSpread serves as a testing helper for EvenPodsSpread feature.
// It builds a fake cluster containing running Pods and Nodes.
// The size of Pods and Nodes are determined by input arguments.
// The specs of Pods and Nodes are generated with the following rules:
//   - Each generated node is applied with a unique label: "node: node<i>".

			hasOldPodsRunning: false,
		},
		{
			name:              "old RSs with running pods",
			oldRSs:            []*apps.ReplicaSet{rsWithUID("some-uid"), rsWithUID("other-uid")},
			podMap:            podMapWithUIDs([]string{"some-uid", "other-uid"}),
			hasOldPodsRunning: true,
		},
		{
			name:              "old RSs without pods but with non-zero status replicas",