if !matched {
		return matched, ""
	}
	for _, me := range ls.MatchExpressions {
		switch me.Operator {
		case metav1.LabelSelectorOpIn, metav1.LabelSelectorOpNotIn:
			if v, exist := objLabels[me.Key]; exist {
				return matched, fmt.Sprintf("%s=%s", me.Key, v)
			}
		}
	}
	return matched, ""
}

func extractRevision(wh *admitv1.MutatingWebhookConfiguration) string {

      nodeSelector:
        kubernetes.io/os: linux
      serviceAccountName: ztunnel
      tolerations:
        - effect: NoSchedule
          operator: Exists
        - key: CriticalAddonsOnly
          operator: Exists
        - effect: NoExecute
          operator: Exists
      containers:
      - name: istio-proxy
{{- if contains "/" .Values.image }}
        image: "{{ .Values.image }}"
{{- else }}

	obj client.Object,
	patch client.Patch,
	opts ...client.PatchOption,
) error {
	// Apply patches are supposed to upsert, but fake client fails if the object doesn't exist,
	// if an apply patch occurs for an object that doesn't yet exist, create it.
	if patch.Type() != types.ApplyPatchType {
		return clnt.Patch(ctx, obj, patch, opts...)
	}
	check, ok := obj.DeepCopyObject().(client.Object)
	if !ok {

  echo Error: curl is not installed or does not support https, wget is not installed. \
       Cannot download envoy. Please install wget or add support of https to curl.
  exit 1
}

# Downloads and extract an Envoy binary if the artifact doesn't already exist.
# Params:
#   $1: The URL of the Envoy tar.gz to be downloaded.
#   $2: The full path of the output binary.
#   $3: Non-versioned name to use

				if !strings.Contains(output, noClusterID) {
					t.Fatal(err)
				}
			}

			checkFiles := map[string]bool{
				// inputs that we allow to exist, if other files seep in unexpectedly we fail the test
				".gitignore": false, "meshconfig.yaml": false, "workloadgroup.yaml": false,
			}
			for k, v := range generated {
				checkFiles[k] = v
			}

  // name is the referenced service. The service must exist in
  // the same namespace as the Ingress object.
  optional string name = 1;

  // port of the referenced service. A port name or port number
  // is required for a IngressServiceBackend.
  optional ServiceBackendPort port = 2;
}

// IngressSpec describes the Ingress the user wishes to exist.
message IngressSpec {

import "k8s.io/apimachinery/pkg/util/intstr/generated.proto";

// Package-wide variables from generator "generated".
option go_package = "k8s.io/api/policy/v1";

// Eviction evicts a pod from its node subject to certain policies and safety constraints.
// This is a subresource of Pod.  A request to cause such an eviction is
// created by POSTing to .../pods/<pod name>/evictions.
message Eviction {

	}

	return client, nil
}

// createHostsideProbeIpset creates an ipset. This is designed to be called from the host netns.
// Note that if the ipset already exist by name, Create will not return an error.
//
// We will unconditionally flush our set before use here, so it shouldn't matter.
func createHostsideProbeIpset(isV6 bool) (ipset.IPSet, error) {
	linDeps := ipset.RealNlDeps()

}

// QueuingConfiguration holds the configuration parameters for queuing
message QueuingConfiguration {
  // `queues` is the number of queues for this priority level. The
  // queues exist independently at each apiserver. The value must be
  // positive.  Setting it to 1 effectively precludes
  // shufflesharding and thus makes the distinguisher method of

}

// QueuingConfiguration holds the configuration parameters for queuing
message QueuingConfiguration {
  // `queues` is the number of queues for this priority level. The
  // queues exist independently at each apiserver. The value must be
  // positive.  Setting it to 1 effectively precludes
  // shufflesharding and thus makes the distinguisher method of