func Test_analyzeRunningWebhooks(t *testing.T) {
	cases := []struct {
		name             string
		pod              *corev1.Pod
		ns               *corev1.Namespace
		expectedMessages []webhookAnalysis
	}{
		{
			name: "no inj because of no match labels",
			pod:  podTestObject("test1", "test1", "", ""),
			ns:   nsTestObject("test1", "", ""),
			expectedMessages: []webhookAnalysis{
				{
					Name:     "istio-sidecar-injector",

	ns string, serviceAccount string, kubeClient kube.CLIClient, options Options,
) (map[string]*discovery.DiscoveryResponse, error) {
	// If Central Istiod case, just call it
	if ns == "" {
		ns = istioNamespace
	}
	if ns == istioNamespace {
		serviceAccount = tokenServiceAccount
	}
	if centralOpts.Xds != "" {

// limitations under the License.

package cli

import "testing"

func Test_handleNamespace(t *testing.T) {
	ns := handleNamespace("test", "default")
	if ns != "test" {
		t.Fatalf("Get the incorrect namespace: %q back", ns)
	}

	tests := []struct {
		description      string
		namespace        string
		defaultNamespace string
		wantNamespace    string
	}{
		{

		return ns.TablePrefix + str
	}

	if ns.SingularTable {
		return ns.TablePrefix + ns.toDBName(str)
	}
	return ns.TablePrefix + inflection.Plural(ns.toDBName(str))
}

// RelationshipFKName generate fk name for relation
func (ns NamingStrategy) RelationshipFKName(rel Relationship) string {
	return ns.formatName("fk", rel.Schema.Table, ns.toDBName(rel.Name))
}

// CheckerName generate checker name

			if err != nil {
				return fmt.Errorf("failed to create Kubernetes client: %v", err)
			}
			var ns string
			if allNamespaces {
				ns = ""
			} else {
				ns = ctx.NamespaceOrDefault(ctx.Namespace())
			}
			gws, err := kubeClient.GatewayAPI().GatewayV1().Gateways(ns).
				List(context.Background(), metav1.ListOptions{})
			if err != nil {
				return err
			}
			if len(gws.Items) == 0 {

	start := UTCNow()
	const readLock = false
	success := make([]int, len(li.paths))
	for i, path := range li.paths {
		if !li.ns.lock(ctx, li.volume, path, lockSource, li.opsID, readLock, timeout.Timeout()) {
			timeout.LogFailure()
			for si, sint := range success {
				if sint == 1 {
					li.ns.unlock(li.volume, li.paths[si], readLock)
				}
			}
			if errors.Is(ctx.Err(), context.Canceled) {

	netns "github.com/containernetworking/plugins/pkg/ns"
	"github.com/prometheus/procfs"
	corev1 "k8s.io/api/core/v1"

	"istio.io/istio/pkg/log"
)

func getPidNamespace(pid int) string {
	return "/host/proc/" + strconv.Itoa(pid) + "/ns/net"
}

func runInHost[T any](f func() (T, error)) (T, error) {
	var res T
	ns := getPidNamespace(1)
	err := netns.WithNetNSPath(ns, func(_ netns.NetNS) error {
		var err error

	pod := &corev1.Pod{ObjectMeta: metav1.ObjectMeta{UID: "testUID"}}
	ns := newFakeNsInode(inc(), 1)
	wl := WorkloadInfo{
		Workload: podToWorkload(pod),
		Netns:    ns,
	}
	netns1 := p.UpsertPodCacheWithNetns(string(pod.UID), wl)
	if !reflect.DeepEqual(netns1, ns) {
		t.Fatalf("Expected the same Netns for the same uid, got %v and %v", netns1, ns)
	}

	ns2 := newFakeNsInode(inc(), 1)
	wl2 := WorkloadInfo{

import "testing"

func TestOpenNetns(t *testing.T) {
	ns, err := OpenNetns("/proc/self/ns/net")
	if err != nil {
		t.Fatalf("unexpected error: %v", err)
	}
	// the inode for netns is proc dynamic, so it needs to be higher than
	// #define PROC_DYNAMIC_FIRST 0xF0000000U

	if ns.Inode() < 0xF0000000 {
		t.Fatalf("unexpected inode: %v", ns.Inode())
	}
	defer ns.Close()

func GetXdsResponse(dr *discovery.DiscoveryRequest, ns string, serviceAccount string, opts clioptions.CentralControlPlaneOptions,
	grpcOpts []grpc.DialOption,
) (*discovery.DiscoveryResponse, error) {
	adscConn, err := adsc.NewWithBackoffPolicy(opts.Xds, &adsc.ADSConfig{
		Config: adsc.Config{
			Meta: model.NodeMetadata{
				Generator:      "event",
				ServiceAccount: serviceAccount,
				Namespace:      ns,
				CloudrunAddr:   opts.IstiodAddr,