ns1/p1:
  k2: v2
ns1/p2:
  k1: v1
  k2: v2
  k3: v33
ns1/p3:
  k1: v1
  k2: v22
  k3: v3
ns1/p4:
  k1: v1
  k4: v4
`

	p1c1 = "ns1/d1/p1/c1"
	p1c2 = "ns1/d1/p1/c2"
	p2c3 = "ns1/d1/p2/c3"
	p3c4 = "ns1/d2/p3/c4"
	p3c5 = "ns1/d2/p3/c5"
	p4c6 = "ns1/d2/p4/c6"

	p1 = []string{p1c1, p1c2}
	p2 = []string{p2c3}
	p3 = []string{p3c4, p3c5}
	p4 = []string{p4c6}

	c.UpdateEndpointPortCache(types.NamespacedName{Namespace: "ns1", Name: "svc1"}, spCacheInefficient)
	expectNumEndpointsAndSlices(t, c, 2, 13, 30)

	c.UpdateEndpointPortCache(types.NamespacedName{Namespace: "ns1", Name: "svc2"}, spCacheEfficient)
	expectNumEndpointsAndSlices(t, c, 4, 15, 110)

	c.UpdateEndpointPortCache(types.NamespacedName{Namespace: "ns1", Name: "svc3"}, spCacheInefficient)
	expectNumEndpointsAndSlices(t, c, 6, 28, 140)

	s.AssertEmpty(t, time.Millisecond*10)

	ns1.Annotations = map[string]string{"foo": "bar"}
	ns.Update(ns1)
	s.AssertEmpty(t, time.Millisecond*10)

	ns2.Annotations = map[string]string{"foo": "bar"}
	ns.Update(ns2)
	s.AssertEmpty(t, time.Millisecond*10)

	ns1.Labels["bar"] = "foo"
	ns.Update(ns1)
	s.AssertEmpty(t, time.Millisecond*10)

	ns2.Labels["foo"] = "bar"
	ns.Update(ns2)

kind: Sidecar
metadata:
  name: no-selector # Since this is the only Sidecar in the namespace without a workload selector, no conflict
  namespace: ns1
spec:
  egress:
  - hosts:
    - "./*"
---
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: has-selector
  namespace: ns1
spec:
  workloadSelector: # Since this has a workload selector, it shouldn't conflict with the other Sidecar in the namespace
    labels:

    name: acme-lb
    group: acme.io
    kind: Parameters
---
apiVersion: v1
kind: Namespace
metadata:
  name: gateway-api-example-ns1
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: my-filter-gateway
  namespace: gateway-api-example-ns1
spec:
  gatewayClassName: filter-lb
  listeners:
    - name: http
      protocol: HTTP
      port: 80
    - name: https

  namespace: istio-config
spec:
  host: "*.local"
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
---
# Services and configs in ns1 namespace
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: http1
  namespace: ns1
spec:
  hosts:
    - http1.ns1.svc.cluster.local
  addresses:
    - 2.1.1.1
  ports:
    - number: 8081
      name: http
      protocol: HTTP2

		want      host.Names
	}{
		{
			[]string{"ns1/foo.com", "ns2/bar.com"},
			"ns1",
			host.Names{"foo.com"},
		},
		{
			[]string{"ns1/foo.com", "ns2/bar.com"},
			"ns3",
			host.Names{},
		},
		{
			[]string{"ns1/foo.com", "*/bar.com"},
			"ns1",
			host.Names{"foo.com", "bar.com"},
		},
		{
			[]string{"ns1/foo.com", "*/bar.com"},
			"ns3",
			host.Names{"bar.com"},

---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
  name: allow-ns1-gateways-to-ref-secrets
  namespace: gateway-api-example-ns2
spec:
  from:
  - group: gateway.networking.k8s.io
    kind: Gateway
    namespace: gateway-api-example-ns1
  to:
  - group: ""

					{
						Settings: &meshconfig.MeshConfig_ServiceSettings_Settings{
							ClusterLocal: true,
						},
						Hosts: []string{
							"*.ns1.svc.cluster.local",
							"*.ns2.svc.cluster.local",
						},
					},
				},
			},
			host:     "s.ns1.svc.cluster.local",
			expected: true,
		},
		{
			name: "local 2",
			m: &meshconfig.MeshConfig{

apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: http-filter-1
  namespace: gateway-api-example-ns1
spec:
  parentRefs:
  - name: my-filter-gateway
    sectionName: http
  hostnames:
  - my-filter.example.com
  rules:
  - filters:
    - type: RequestRedirect
      requestRedirect:
        path:
          type: ReplaceFullPath