apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio-injection: enabled
  name: enabled-namespace
---
# Namespace 'enabled-namespace-2' has istio injection enabled, so will be enforced.
apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio-injection: enabled
  name: enabled-namespace-2
---
# Details-v1-pod-old is out of date and should get a warning.
apiVersion: v1
kind: Pod
metadata:
  labels:

enum Version {
  NOT_USED = 0;
  V1 = 1;
}

message ZdsHello {
  Version version = 1;
}

message WorkloadInfo {
  reserved "trust_domain"; // Deprecated
  reserved 4;
  string name = 1;
  string namespace = 2;
  string service_account = 3;
}

// Add a workload to the ztunnel. this will be accompanied by ancillary data contianing
// the workload's netns file descriptor.
message AddWorkload {
  string uid = 1;

syntax = "proto3";

package istio.security;
option go_package="pkg/workloadapi/security";

import "google/protobuf/empty.proto";

message Authorization {
  string name = 1;
  string namespace = 2;

  // Determine the scope of this RBAC policy.
  // If set to NAMESPACE, the 'namespace' field value will be used.
  Scope scope = 3;
  // The action to take if the request is matched with the rules.

        NamespaceId id1 = new NamespaceId(namespace1, name1)
        NamespaceId id2 = new NamespaceId(namespace2, name2)

        expect:
        ! id1.equals(id2)
        id1.hashCode() != id2.hashCode()

        where:
        namespace1        | name1        | namespace2        | name2
        "some-namespace1" | "some-name"  | "some-namespace2" | "some-name"
        "some-namespace"  | "some-name1" | "some-namespace"  | "some-name2"

			attr:           admission.NewAttributesRecord(&namespace2, nil, schema.GroupVersionKind{}, namespace2.Name, namespace2.Name, schema.GroupVersionResource{Resource: "namespaces"}, "", admission.Update, &metav1.UpdateOptions{}, false, nil),
			expectedLabels: namespace2Labels,
		},
		{
			name:           "request is for deleting namespace, the labels should be from the cache",

			tag:               "1.2.3",
			imagePullSecrets:  []string{"imagePullSecret1,imagePullSecret2"},
			operatorNamespace: "operator-test-namespace",
			watchedNamespaces: "istio-test-namespace1,istio-test-namespace2",
		},
	}

	cmd := "operator dump --hub " + odArgs.common.hub
	cmd += " --tag " + odArgs.common.tag
	cmd += " --imagePullSecrets " + strings.Join(odArgs.common.imagePullSecrets, ",")

    - protocol: TCP
      port: 8080
      targetPort: 8080
    - protocol: TCP
      port: 8081
      targetPort: 8081
---
apiVersion: v1
kind: Service
metadata:
  name: my-service2
  namespace: my-namespace2
spec:
  selector:
    app: my-service2
  ports:
    - name: foo
      protocol: TCP
      port: 8080

                        regex: .*/ns/namespaces1/.*
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: .*/ns/namespaces2/.*
      ns[foo]-policy[httpbin-8]-rule[0]:
        permissions:
        - andRules:
            rules:
            - any: true
        principals:
        - andIds:
            ids:

                        regex: .*/ns/namespaces1/.*
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: .*/ns/namespaces2/.*
      ns[foo]-policy[httpbin-8]-rule[0]:
        permissions:
        - andRules:
            rules:
            - any: true
        principals:
        - andIds:
            ids:

	// Namespace1 is used as the default namespace for reachability tests and other tests which can reuse the same config for echo instances
	Namespace1 namespace.Instance
	// Namespace2 is used by most authorization test cases within authorization_test.go
	Namespace2 namespace.Instance
	// Namespace3 is used by TestAuthorization_Conditions and there is one C echo instance deployed
	Namespace3    namespace.Instance
	A, B, C, D, E echo.Instances