}

// MustToGVR converts a GVK to a GVR, and panics if it cannot be converted
// Warning: this is only safe for known types; do not call on arbitrary GVKs
func MustToGVR(g config.GroupVersionKind) schema.GroupVersionResource {
	r, ok := ToGVR(g)
	if !ok {
		panic("unknown kind: " + g.String())
	}
	return r
}

// FromGVR converts a GVR to a GVK.

		return EndpointSlice
	case gvk.Endpoints:
		return Endpoints
	case gvk.EnvoyFilter:
		return EnvoyFilter
	case gvk.GRPCRoute:
		return GRPCRoute
	case gvk.Gateway:
		return Gateway
	case gvk.GatewayClass:
		return GatewayClass
	case gvk.HTTPRoute:
		return HTTPRoute
	case gvk.Ingress:
		return Ingress
	case gvk.IngressClass:
		return IngressClass
	case gvk.KubernetesGateway:

		return gvk.ConfigMap, true
	case *k8sioapiextensionsapiserverpkgapisapiextensionsv1.CustomResourceDefinition:
		return gvk.CustomResourceDefinition, true
	case *k8sioapiappsv1.DaemonSet:
		return gvk.DaemonSet, true
	case *k8sioapiappsv1.Deployment:
		return gvk.Deployment, true
	case *istioioapinetworkingv1alpha3.DestinationRule:
		return gvk.DestinationRule, true
	case *apiistioioapinetworkingv1alpha3.DestinationRule:

	"istio.io/istio/pkg/config"
	"istio.io/istio/pkg/config/schema/gvk"
	"istio.io/istio/pkg/ptr"
	"istio.io/istio/pkg/typemap"
)

func MustGVRFromType[T runtime.Object]() schema.GroupVersionResource {
	if gk, ok := getGvk(ptr.Empty[T]()); ok {
		gr, ok := gvk.ToGVR(gk)
		if !ok {
			panic(fmt.Sprintf("unknown GVR for GVK %v", gk))
		}
		return gr
	}

		}
		// Deserialize the TypeMeta information of this byte slice
		gvk, err := yamlserializer.DefaultMetaFactory.Interpret(b)
		if err != nil {
			return nil, err
		}
		if len(gvk.Group) == 0 || len(gvk.Version) == 0 || len(gvk.Kind) == 0 {
			return nil, errors.Errorf("invalid configuration for GroupVersionKind %+v: kind and apiVersion is mandatory information that must be specified", gvk)
		}

		Description: "Checks the validity of authorization policies",
		Inputs: []config.GroupVersionKind{
			gvk.MeshConfig,
			gvk.AuthorizationPolicy,
			gvk.Namespace,
			gvk.Pod,
		},
	}
}

func (a *AuthorizationPoliciesAnalyzer) Analyze(c analysis.Context) {
	podLabelsMap := initPodLabelsMap(c)

	c.ForEach(gvk.AuthorizationPolicy, func(r *resource.Instance) bool {
		a.analyzeNoMatchingWorkloads(r, c, podLabelsMap)

	"istio.io/istio/pkg/config/resource"
	"istio.io/istio/pkg/config/schema/gvk"
	"istio.io/istio/pkg/maps"
)

var _ analysis.Analyzer = &SelectorAnalyzer{}

type SelectorAnalyzer struct{}

var policyGVKs = []config.GroupVersionKind{
	gvk.AuthorizationPolicy,
	gvk.RequestAuthentication,
	gvk.Telemetry,
	gvk.WasmPlugin,
}

type policy interface {
	GetSelector() *typev1beta1.WorkloadSelector

}

// ResolveSchema takes a GroupVersionKind (GVK) and returns the OpenAPI schema
// identified by the GVK.
// If the DefinitionsSchemaResolver knows the gvk, the DefinitionsSchemaResolver handles the resolution,
// otherwise, the secondary does.
func (r *combinedSchemaResolver) ResolveSchema(gvk schema.GroupVersionKind) (*spec.Schema, error) {
	if _, ok := r.definitions.gvkToRef[gvk]; ok {
		return r.definitions.ResolveSchema(gvk)
	}

func (r *ClientDiscoveryResolver) ResolveSchema(gvk schema.GroupVersionKind) (*spec.Schema, error) {
	p, err := r.Discovery.OpenAPIV3().Paths()
	if err != nil {
		return nil, err
	}
	resourcePath := resourcePathFromGV(gvk.GroupVersion())
	c, ok := p[resourcePath]
	if !ok {
		return nil, fmt.Errorf("cannot resolve group version %q: %w", gvk.GroupVersion(), ErrSchemaNotFound)
	}

// IsAggregatedDiscoveryGVK checks if a provided GVK is the GVK for serving aggregated discovery.
func IsAggregatedDiscoveryGVK(gvk *schema.GroupVersionKind) bool {
	if gvk != nil {
		return gvk.Group == "apidiscovery.k8s.io" && (gvk.Version == "v2beta1" || gvk.Version == "v2") && gvk.Kind == "APIGroupDiscoveryList"
	}
	return false