return EndpointSlice
	case gvk.Endpoints:
		return Endpoints
	case gvk.EnvoyFilter:
		return EnvoyFilter
	case gvk.GRPCRoute:
		return GRPCRoute
	case gvk.Gateway:
		return Gateway
	case gvk.GatewayClass:
		return GatewayClass
	case gvk.HTTPRoute:
		return HTTPRoute
	case gvk.Ingress:
		return Ingress
	case gvk.IngressClass:
		return IngressClass
	case gvk.KubernetesGateway:

		return gvk.ConfigMap, true
	case *k8sioapiextensionsapiserverpkgapisapiextensionsv1.CustomResourceDefinition:
		return gvk.CustomResourceDefinition, true
	case *k8sioapiappsv1.DaemonSet:
		return gvk.DaemonSet, true
	case *k8sioapiappsv1.Deployment:
		return gvk.Deployment, true
	case *istioioapinetworkingv1alpha3.DestinationRule:
		return gvk.DestinationRule, true
	case *apiistioioapinetworkingv1alpha3.DestinationRule:

	"istio.io/istio/pkg/config"
	"istio.io/istio/pkg/config/schema/gvk"
	"istio.io/istio/pkg/ptr"
	"istio.io/istio/pkg/typemap"
)

func MustGVRFromType[T runtime.Object]() schema.GroupVersionResource {
	if gk, ok := getGvk(ptr.Empty[T]()); ok {
		gr, ok := gvk.ToGVR(gk)
		if !ok {
			panic(fmt.Sprintf("unknown GVR for GVK %v", gk))
		}
		return gr
	}

		}
		// Deserialize the TypeMeta information of this byte slice
		gvk, err := yamlserializer.DefaultMetaFactory.Interpret(b)
		if err != nil {
			return nil, err
		}
		if len(gvk.Group) == 0 || len(gvk.Version) == 0 || len(gvk.Kind) == 0 {
			return nil, errors.Errorf("invalid configuration for GroupVersionKind %+v: kind and apiVersion is mandatory information that must be specified", gvk)
		}

// IsAggregatedDiscoveryGVK checks if a provided GVK is the GVK for serving aggregated discovery.
func IsAggregatedDiscoveryGVK(gvk *schema.GroupVersionKind) bool {
	if gvk != nil {
		return gvk.Group == "apidiscovery.k8s.io" && (gvk.Version == "v2beta1" || gvk.Version == "v2") && gvk.Kind == "APIGroupDiscoveryList"
	}
	return false

	if orig.GroupVersionKind != mod.GroupVersionKind {
		return nil, fmt.Errorf("gvk mismatch: %v, modified: %v", orig.GroupVersionKind, mod.GroupVersionKind)
	}
	switch orig.GroupVersionKind {
{{- range .Entries }}
	{{- if and (not .Resource.Synthetic) (not .Resource.Builtin) }}
	case gvk.{{.Resource.Identifier}}:
		oldRes := &{{ .IstioAwareClientImport }}.{{ .Resource.Kind }}{
				ObjectMeta: origMeta,

func (fa *AlphaAnalyzer) Analyze(ctx analysis.Context) {
	ctx.ForEach(gvk.Namespace, func(r *resource.Instance) bool {
		fa.allowAnnotations(r, ctx, gvk.Namespace)
		return true
	})
	ctx.ForEach(gvk.Service, func(r *resource.Instance) bool {
		fa.allowAnnotations(r, ctx, gvk.Service)
		return true
	})
	ctx.ForEach(gvk.Pod, func(r *resource.Instance) bool {
		fa.allowAnnotations(r, ctx, gvk.Pod)
		return true
	})

		Description: "Checks if caCertificates is set when TLS mode is SIMPLE/MUTUAL",
		Inputs: []config.GroupVersionKind{
			gvk.DestinationRule,
		},
	}
}

func (c *CaCertificateAnalyzer) Analyze(ctx analysis.Context) {
	ctx.ForEach(gvk.DestinationRule, func(r *resource.Instance) bool {
		c.analyzeDestinationRule(r, ctx)
		return true
	})
}

			"match at least one pod, and that there aren't multiple sidecar resources that select overlapping pods",
		Inputs: []config.GroupVersionKind{
			gvk.Sidecar,
			gvk.Pod,
			gvk.Namespace,
		},
	}
}

// Analyze implements Analyzer
func (a *SelectorAnalyzer) Analyze(c analysis.Context) {
	podsToSidecars := make(map[resource.FullName][]*resource.Instance)

		if kubeadmutil.GroupVersionKindsHasInitConfiguration(gvk) || kubeadmutil.GroupVersionKindsHasClusterConfiguration(gvk) {
			klog.Warningf("[config] WARNING: YAML document with GroupVersionKind %v is deprecated for upgrade, please use config file with kind of UpgradeConfiguration instead \n", gvk)
			continue
		}

		if kubeadmutil.GroupVersionKindsHasUpgradeConfiguration(gvk) {
			// Set internalcfg to an empty struct value the deserializer will populate