extensions.PluginPhase_AUTHN: {
					convertToWasmPluginWrapper(wasmPlugins["authn-med-prio-all"]),
					convertToWasmPluginWrapper(wasmPlugins["authn-low-prio-all-network"]),
					convertToWasmPluginWrapper(wasmPlugins["authn-low-prio-all"]),
					convertToWasmPluginWrapper(wasmPlugins["global-authn-low-prio-ingress"]),
				},
			},
		},
		{
			name: "testns-2",

	case gvk.WasmPlugin:
		oldRes := &apiistioioapiextensionsv1alpha1.WasmPlugin{
			ObjectMeta: origMeta,
			Spec:       *(orig.Spec.(*istioioapiextensionsv1alpha1.WasmPlugin)),
		}
		modRes := &apiistioioapiextensionsv1alpha1.WasmPlugin{
			ObjectMeta: modMeta,
			Spec:       *(mod.Spec.(*istioioapiextensionsv1alpha1.WasmPlugin)),
		}
		patchBytes, err := genPatchBytes(oldRes, modRes, typ)

}

// pre computes WasmPlugins per namespace
func (ps *PushContext) initWasmPlugins(env *Environment) {
	wasmplugins := env.List(gvk.WasmPlugin, NamespaceAll)

	sortConfigByCreationTime(wasmplugins)
	ps.wasmPluginsByNamespace = map[string][]*WasmPluginWrapper{}
	for _, plugin := range wasmplugins {
		if pluginWrapper := convertToWasmPluginWrapper(plugin); pluginWrapper != nil {

		Spec: &extensions.WasmPlugin{
			Phase: extensions.PluginPhase_AUTHZ,
			Type:  extensions.PluginType_NETWORK,
		},
	},
	{
		Meta: config.Meta{Name: "wasm-network-authn", Namespace: "istio-system", GroupVersionKind: gvk.WasmPlugin},
		Spec: &extensions.WasmPlugin{
			Phase: extensions.PluginPhase_AUTHN,

		}},
		{"WasmPlugin in same ns as workload", []string{"*/*"}, map[ConfigKey]bool{
			{kind.WasmPlugin, "wasm", "default"}: true,
		}},
		{"WasmPlugin in different ns from workload", []string{"*/*"}, map[ConfigKey]bool{
			{kind.WasmPlugin, "wasm", "ns1"}: false,
		}},
		{"WasmPlugin in the root namespace", []string{"*/*"}, map[ConfigKey]bool{
			{kind.WasmPlugin, "wasm", constants.IstioSystemNamespace}: true,