apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio-injection: enabled
  name: enabled-namespace
---
# Namespace 'enabled-namespace-2' has istio injection enabled, so will be enforced.
apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio-injection: enabled
  name: enabled-namespace-2
---
# Details-v1-pod-old is out of date and should get a warning.
apiVersion: v1
kind: Pod
metadata:
  labels:

# Migration from istio-system

Istio 1.0 includes the gateways in istio-system. Since the external IP is associated
with the Service and bound to the namespace, it is recommended to:

1. Install the new gateway in a new namespace.
2. Copy any TLS certificate to the new namespace, and configure the domains.
3. Checking the new gateway work - for example by overriding the IP in /etc/hosts
4. Modify the DNS server to add the A record of the new namespace

# Migration from istio-system

Istio 1.0 includes the gateways in istio-system. Since the external IP is associated
with the Service and bound to the namespace, it is recommended to:

1. Install the new gateway in a new namespace.
2. Copy any TLS certificate to the new namespace, and configure the domains.
3. Checking the new gateway work - for example by overriding the IP in /etc/hosts
4. Modify the DNS server to add the A record of the new namespace

enum Version {
  NOT_USED = 0;
  V1 = 1;
}

message ZdsHello {
  Version version = 1;
}

message WorkloadInfo {
  reserved "trust_domain"; // Deprecated
  reserved 4;
  string name = 1;
  string namespace = 2;
  string service_account = 3;
}

// Add a workload to the ztunnel. this will be accompanied by ancillary data contianing
// the workload's netns file descriptor.
message AddWorkload {
  string uid = 1;

syntax = "proto3";

package istio.security;
option go_package="pkg/workloadapi/security";

import "google/protobuf/empty.proto";

message Authorization {
  string name = 1;
  string namespace = 2;

  // Determine the scope of this RBAC policy.
  // If set to NAMESPACE, the 'namespace' field value will be used.
  Scope scope = 3;
  // The action to take if the request is matched with the rules.

        NamespaceId id1 = new NamespaceId(namespace1, name1)
        NamespaceId id2 = new NamespaceId(namespace2, name2)

        expect:
        ! id1.equals(id2)
        id1.hashCode() != id2.hashCode()

        where:
        namespace1        | name1        | namespace2        | name2
        "some-namespace1" | "some-name"  | "some-namespace2" | "some-name"
        "some-namespace"  | "some-name1" | "some-namespace"  | "some-name2"

			attr:           admission.NewAttributesRecord(&namespace2, nil, schema.GroupVersionKind{}, namespace2.Name, namespace2.Name, schema.GroupVersionResource{Resource: "namespaces"}, "", admission.Update, &metav1.UpdateOptions{}, false, nil),
			expectedLabels: namespace2Labels,
		},
		{
			name:           "request is for deleting namespace, the labels should be from the cache",

			tag:               "1.2.3",
			imagePullSecrets:  []string{"imagePullSecret1,imagePullSecret2"},
			operatorNamespace: "operator-test-namespace",
			watchedNamespaces: "istio-test-namespace1,istio-test-namespace2",
		},
	}

	cmd := "operator dump --hub " + odArgs.common.hub
	cmd += " --tag " + odArgs.common.tag
	cmd += " --imagePullSecrets " + strings.Join(odArgs.common.imagePullSecrets, ",")

    - protocol: TCP
      port: 8080
      targetPort: 8080
    - protocol: TCP
      port: 8081
      targetPort: 8081
---
apiVersion: v1
kind: Service
metadata:
  name: my-service2
  namespace: my-namespace2
spec:
  selector:
    app: my-service2
  ports:
    - name: foo
      protocol: TCP
      port: 8080

---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: httpbin-7
  namespace: foo
spec:
  rules:
    - from:
        - source:
            namespaces: ["namespaces1", "namespaces2"]
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: httpbin-8
  namespace: foo
spec:
  rules:
    - from:
        - source: