return fmt.Errorf("webhook #%v: wrong failure policy. c %v wanted %v",
				i, *wh.FailurePolicy, kubeApiAdmission.Fail)
		}
		if len(wh.ClientConfig.CABundle) == 0 {
			return fmt.Errorf("webhook #%v: caBundle not patched", i)
		}
	}
	return nil
}

func verifyRejectsInvalidConfig(t framework.TestContext, configRevision string, shouldReject bool) {
	t.Helper()
	const istioNamespace = "istio-system"

# patched versions result in a higher-than-patch upgrade.

cp go.mod.orig go.mod
! go get -u=patch all
stderr '^go: example.net/a@v0.1.1 \(matching all@patch\) requires example.net/b@v0.2.0, not example.net/b@v0.1.1 \(matching all@patch\)$'
cmp go.mod go.mod.orig


# On the other hand, "-u=patch ./..." should patch-upgrade dependencies until
# they reach a fixed point, even if that results in higher-than-patch upgrades.

go get -u=patch ./...

// WebhookCertPatcher listens for webhooks on specified revision and patches their CA bundles
type WebhookCertPatcher struct {
	// revision to patch webhooks for
	revision    string
	webhookName string

	queue controllers.Queue

	// File path to the x509 certificate bundle used by the webhook server
	// and patched into the webhook config.
	CABundleWatcher *keycertbundle.Watcher

	webhooks kclient.Client[*v1.MutatingWebhookConfiguration]

		return
	}
	if pod.Spec.DNSPolicy != "" {
		t.Errorf("DNSPolicy should be empty but: %v", pod.Spec.DNSPolicy)
	}

	if _, ok := pod.ObjectMeta.Annotations["patched"]; !ok {
		t.Errorf("Patches were not applied to %s", kubeadmconstants.Etcd)
	}
}

func TestGetEtcdCommand(t *testing.T) {
	var tests = []struct {
		name             string
		advertiseAddress string

	if err != nil {
		return pod, errors.Wrapf(err, "failed to marshal Pod manifest to YAML")
	}

	patchManager, err := patches.GetPatchManagerForPath(patchesDir, patches.KnownTargets(), output)
	if err != nil {
		return pod, err
	}

	patchTarget := &patches.PatchTarget{
		Name:                      pod.Name,
		StrategicMergePatchObject: v1.Pod{},
		Data:                      podYAML,
	}

		return nil, fmt.Errorf("failed to process pod: %v", err)
	}

	patch, err := createPatch(mergedPod, originalPodSpec)
	if err != nil {
		return nil, fmt.Errorf("failed to create patch: %v", err)
	}

	log.Debugf("AdmissionResponse: patch=%v\n", string(patch))
	return patch, nil
}

	if err != nil {
		t.Fatal(err)
	}

	crd, err = apiExtensionClient.ApiextensionsV1().CustomResourceDefinitions().Get(context.TODO(), crd.Name, metav1.GetOptions{})
	if err != nil {
		t.Fatal(err)
	}
	t.Logf("columns crd patched: %#v", crd)
}

	_, err := c.Fake.Invokes(action, &v1.CustomResourceDefinitionList{})
	return err
}

// Patch applies the patch and returns the patched customResourceDefinition.
func (c *FakeCustomResourceDefinitions) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *v1.CustomResourceDefinition, err error) {

    }

    // This test demonstrated the current behavior for how a module compilation of sources in one 'source directory set' and be patched with the result of another.
    // If we add higher level modeling concepts for the relationship between the compile steps on one source set, the '--patch-module' arguments could maybe be derived automatically.

	action := testing.NewDeleteCollectionAction(examplesResource, c.ns, listOpts)

	_, err := c.Fake.Invokes(action, &v1.ExampleList{})
	return err
}

// Patch applies the patch and returns the patched example.
func (c *FakeExamples) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *v1.Example, err error) {
	emptyResult := &v1.Example{}