}
	c.pods = kclient.New[*v1.Pod](cl)
	c.services = kclient.New[*v1.Service](cl)
	c.queue = controllers.NewQueue("pods", controllers.WithReconciler(c.Reconcile))
	c.pods.AddEventHandler(controllers.ObjectHandler(c.queue.AddObject))
	c.services.AddEventHandler(controllers.FromEventHandler(func(e controllers.Event) {
		o := e.Latest()

	pleg := newTestGenericPLEGWithRuntimeMock(runtimeMock)
	ch := pleg.Watch()

	pods, statuses, events := createTestPodsStatusesAndEvents(2)
	runtimeMock.EXPECT().GetPods(ctx, true).Return(pods, nil).AnyTimes()
	runtimeMock.EXPECT().GetPodStatus(ctx, pods[0].ID, "", "").Return(statuses[0], nil).Times(1)
	// Inject an error when querying runtime for the pod status for pods[1].
	statusErr := fmt.Errorf("unable to get status")

	// just in case the proxy ID is bad formatted
	pods := pc.getPodsByIP(proxyIP)
	switch len(pods) {
	case 0:
		return nil
	case 1:
		return pods[0]
	default:
		// This should only happen with hostNetwork pods, which cannot be proxy clients...
		log.Errorf("unexpected: found multiple pods for proxy %v (%v)", proxy.ID, proxyIP)
		// Try to handle it gracefully
		for _, p := range pods {
			// At least filter out wrong namespaces...

1. By running as a node-level daemonset that:

- listens for these UDS events from the CNI plugin (which fire when new pods are spawned in an ambient-enabled namespace), and adds those pods to the ambient mesh.
- watches k8s resource for existing pods, so that pods that have already been started can be moved in or out of the ambient mesh.

			"GET" + "/api/v1/namespaces/ns1/pods/rc1Pod1": {
				200,
				serilizeOrDie(t, rc1Pod1),
			},
			"GET" + "/api/v1/namespaces/ns1/pods/rc1Pod2": {
				200,
				serilizeOrDie(t, rc1Pod2),
			},
			"GET" + "/api/v1/namespaces/ns1/pods/rc2Pod1": {
				200,
				serilizeOrDie(t, rc2Pod1),
			},
			"GET" + "/api/v1/namespaces/ns1/pods/rc3Pod1": {
				200,
				serilizeOrDie(t, rc3Pod1),

	podCount := 1000
	var pods []*example.Pod
	for i := 0; i < podCount; i++ {
		obj := &example.Pod{ObjectMeta: metav1.ObjectMeta{Name: fmt.Sprintf("pod-%d", i)}}
		key := computePodKey(obj)
		storedObj := &example.Pod{}
		err := store.Create(ctx, key, obj, storedObj, 0)
		if err != nil {
			t.Fatalf("Set failed: %v", err)
		}
		pods = append(pods, storedObj)
	}

}

// Get a list of pods that have data directories.
func (kl *Kubelet) listPodsFromDisk() ([]types.UID, error) {
	podInfos, err := os.ReadDir(kl.getPodsDir())
	if err != nil {
		return nil, err
	}
	pods := []types.UID{}
	for i := range podInfos {
		if podInfos[i].IsDir() {
			pods = append(pods, types.UID(podInfos[i].Name()))
		}
	}
	return pods, nil
}

// of computing priority only. This ensures that when scheduling zero-request pods, such
// pods will not all be scheduled to the node with the smallest in-use request,
// and that when scheduling regular pods, such pods will not see zero-request pods as
// consuming no resources whatsoever. We chose these values to be similar to the
// resources that we give to cluster addon pods (#10653). But they are pretty arbitrary.

  // can have their pods stopped for an update at any given time. The update
  // starts by stopping at most 30% of those DaemonSet pods and then brings
  // up new DaemonSet pods in their place. Once the new pods are available,
  // it then proceeds onto other DaemonSet pods, thus ensuring that at least
  // 70% of original number of DaemonSet pods are available at all times during
  // the update.

	manager.dsStore.Update(ds)

	// all old pods are unavailable so should be surged
	manager.failedPodsBackoff.Clock = testingclock.NewFakeClock(time.Unix(100, 0))
	clearExpectations(t, manager, ds, podControl)
	expectSyncDaemonSets(t, manager, ds, podControl, 5, 0, 0)

	// waiting for pods to go ready, old pods are deleted
	manager.failedPodsBackoff.Clock = testingclock.NewFakeClock(time.Unix(200, 0))