Namespace:    "istio-system",
		ResourceName: "istio-system.someAuthNFilter",
		WasmPlugin: &extensions.WasmPlugin{
			Priority: &wrapperspb.Int32Value{Value: 1},
		},
	}
	someAuthZFilter = &model.WasmPluginWrapper{
		Name:         "someAuthZFilter",
		Namespace:    "istio-system",
		ResourceName: "istio-system.someAuthZFilter",
		WasmPlugin: &extensions.WasmPlugin{
			Priority: &wrapperspb.Int32Value{Value: 1000},
		},
	}

// InsertedExtensionConfigurations builds added via WasmPlugin.
func InsertedExtensionConfigurations(
	wasmPlugins []*model.WasmPluginWrapper,
	names []string, pullSecrets map[string][]byte,
) []*core.TypedExtensionConfig {
	result := make([]*core.TypedExtensionConfig, 0)
	if len(wasmPlugins) == 0 {
		return result
	}
	hasName := sets.New(names...)
	for _, p := range wasmPlugins {
		if !hasName.Contains(p.ResourceName) {

	// * Secret are referenced by a WasmPlugin which applies to this proxy.
	// TODO: we get the WasmPlugins here to get the secrets reference in order to decide whether ECDS push is needed,
	//       and we will get it again at extension config build. Avoid getting it twice if this becomes a problem.
	watched := sets.New(resourceNames...)
	wasmPlugins := push.WasmPlugins(proxy)
	referencedSecrets := sets.String{}

	envoyFilterPatches := push.EnvoyFilters(proxy)
	extensions := envoyfilter.InsertedExtensionConfigurations(envoyFilterPatches, extensionConfigNames)
	wasmPlugins := push.WasmPluginsByName(proxy, parseExtensionName(extensionConfigNames))
	extensions = append(extensions, extension.InsertedExtensionConfigurations(wasmPlugins, extensionConfigNames, pullSecrets)...)
	return extensions
}

func parseExtensionName(names []string) []types.NamespacedName {

apiVersion: release-notes/v2
kind: feature
area: extensibility
issue: []
releaseNotes:
  - |

apiVersion: extensions.istio.io/v1alpha1
kind: WasmPlugin
metadata:
  name: valid
spec:
  selector:
    matchLabels:
      istio: ingressgateway
  url: oci://private-registry:5000/openid-connect/openid:latest
  imagePullPolicy: IfNotPresent
  imagePullSecret: private-registry-pull-secret
  phase: AUTHN
  pluginConfig:
    openid_server: authn

		return "Telemetry"
	case UDPRoute:
		return "UDPRoute"
	case ValidatingWebhookConfiguration:
		return "ValidatingWebhookConfiguration"
	case VirtualService:
		return "VirtualService"
	case WasmPlugin:
		return "WasmPlugin"
	case WorkloadEntry:
		return "WorkloadEntry"
	case WorkloadGroup:
		return "WorkloadGroup"
	default:
		return "Unknown"
	}
}

func MustFromGVK(g config.GroupVersionKind) Kind {

apiVersion: release-notes/v2
kind: feature
area: extensibility
issue: [39345]
releaseNotes:
  - |

		return gvk.VirtualService, true
	case *apiistioioapinetworkingv1alpha3.VirtualService:
		return gvk.VirtualService, true
	case *istioioapiextensionsv1alpha1.WasmPlugin:
		return gvk.WasmPlugin, true
	case *apiistioioapiextensionsv1alpha1.WasmPlugin:
		return gvk.WasmPlugin, true
	case *istioioapinetworkingv1alpha3.WorkloadEntry:
		return gvk.WorkloadEntry, true
	case *apiistioioapinetworkingv1alpha3.WorkloadEntry:

apiVersion: extensions.istio.io/v1alpha1
kind: WasmPlugin
metadata:
  name: istio.attributegen
spec:
  phase: STATS
  selector:
    matchLabels:
      app: b
  url: {{ .AttributeGenURL }}
  imagePullSecret: reg-cred
  pluginConfig:
    attributes:
    - output_attribute: istio_responseClass
      match:
      - value: 2xx
        condition: response.code >= 200 && response.code <= 299
    - output_attribute: istio_operationId