}

		whObject, _, err := deserializer.Decode([]byte(webhookYAML), nil, &admitv1.MutatingWebhookConfiguration{})
		if err != nil {
			t.Fatalf("could not parse webhook from generated YAML: %s", webhookYAML)
		}
		wh := whObject.(*admitv1.MutatingWebhookConfiguration)

		// expect both namespace.sidecar-injector.istio.io and object.sidecar-injector.istio.io webhooks

                      pods/VMs on which a policy should be applied.
                    type: object
                type: object
            required:
            - host
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: false
    subresources:
      status: {}

  // it acts on some changes in a ReplicaSet object.
  // +optional
  optional k8s.io.api.core.v1.ObjectReference regarding = 8;

  // related is the optional secondary object for more complex actions. E.g. when regarding object triggers
  // a creation or deletion of related object.
  // +optional
  optional k8s.io.api.core.v1.ObjectReference related = 9;

    - key: sidecar.istio.io/inject
      operator: NotIn
      values:
      - "false"

{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
  namespaceSelector:
    matchExpressions:
    - key: istio-injection
      operator: DoesNotExist
    - key: istio.io/rev

  // UserInfo is information about the requesting user
  optional k8s.io.api.authentication.v1.UserInfo userInfo = 8;

  // Object is the object from the incoming request.
  // +optional
  optional k8s.io.apimachinery.pkg.runtime.RawExtension object = 9;

  // OldObject is the existing object. Only populated for DELETE and UPDATE requests.
  // +optional
  optional k8s.io.apimachinery.pkg.runtime.RawExtension oldObject = 10;

      source, and configuration files.

      "Object" form shall mean any form resulting from mechanical
      transformation or translation of a Source form, including but
      not limited to compiled object code, generated documentation,
      and conversions to other media types.

      "Work" shall mean the work of authorship, whether in Source or
      Object form, made available under the License, as indicated by a

)

// execAndK8sConfigTestCase lets a test case hold some Envoy, Istio, and Kubernetes configuration
type execAndK8sConfigTestCase struct {
	k8sConfigs     []runtime.Object // Canned K8s configuration
	istioConfigs   []runtime.Object // Canned Istio configuration
	configDumps    map[string][]byte
	namespace      string
	istioNamespace string

	args []string

	// Typically use one of the three

// the DaemonSet and StatefulSet controllers for update and rollback, this object is beta. However,
// it may be subject to name and representation changes in future releases, and clients should not
// depend on its stability. It is primarily for internal use by controllers.
message ControllerRevision {
  // Standard object's metadata.

		nsNames[i] = ns.Name
	}
	return nsNames, nil
}

// GetWebhookTagName extracts tag name from webhook object.
func GetWebhookTagName(wh admitv1.MutatingWebhookConfiguration) string {
	return wh.ObjectMeta.Labels[IstioTagLabel]
}

// GetWebhookRevision extracts tag target revision from webhook object.
func GetWebhookRevision(wh admitv1.MutatingWebhookConfiguration) (string, error) {

// request header authentication is used, any extra keys will have their case ignored and returned as lowercase.
message SelfSubjectReview {
  // Standard object's metadata.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;