if wr == nil {
					wr = &model.WatchedResource{TypeUrl: res.TypeUrl}
				}
				// some resources dynamically update ResourceNames. Most don't though
				if newResourceNames != nil {
					wr.ResourceNames = newResourceNames
				}
				wr.NonceSent = res.Nonce
				if features.EnableUnsafeDeltaTest {
					wr.LastResources = applyDelta(wr.LastResources, res)
				}

  - routes
  verbs:
  - get
- apiGroups: ["authentication.k8s.io"]
  resources:
  - tokenreviews
  verbs:
  - create
- apiGroups: ["oauth.openshift.io"]
  resources:
  - oauthclients
  resourceNames:
  - kiali-istio-system
  verbs:
  - get
...
---
# Source: kiali-server/templates/rolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kiali

	if strings.HasPrefix(req.TypeUrl, v3.DebugType) {
		return s.pushXds(con,
			&model.WatchedResource{TypeUrl: req.TypeUrl, ResourceNames: req.ResourceNames},
			&model.PushRequest{Full: true, Push: con.proxy.LastPushContext})
	}

	if s.StatusReporter != nil {
		s.StatusReporter.RegisterEvent(con.ID(), req.TypeUrl, req.ResponseNonce)
	}

	shouldRespond, delta := xds.ShouldRespond(con.proxy, con.ID(), req)
	if !shouldRespond {

		return
	}
	newByName := slices.GroupUnique(sotwRes, (*discovery.Resource).GetName)
	curByName := slices.GroupUnique(current, (*discovery.Resource).GetName)

	watched := sets.New(w.ResourceNames...)

	details := fmt.Sprintf("last:%v sotw:%v delta:%v-%v", len(current), len(sotwRes), len(deltaRes), len(deleted))
	wantDeleted := sets.New[string]()
	wantChanged := sets.New[string]()

	servicePortClusters := make(map[string]map[int]string)
	// Holds subset clusters per service, keyed by hostname.
	subsetClusters := make(map[string]sets.String)

	for _, cluster := range watched.ResourceNames {
		// WatchedResources.ResourceNames will contain the names of the clusters it is subscribed to. We can
		// check with the name of our service (cluster names are in the format outbound|<port>|<subset>|<hostname>).

	defer node.RUnlock()
	wr := node.WatchedResources[v3.EndpointType]
	if wr != nil {
		return wr.ResourceNames
	}
	return nil
}

func (node *Proxy) NewWatchedResource(typeURL string, names []string) {
	node.Lock()
	defer node.Unlock()

	node.WatchedResources[typeURL] = &WatchedResource{TypeUrl: typeURL, ResourceNames: names}
	// For all EDS requests that we have already responded with in the same stream let us

				proxy.PrevSidecarScope.SetDestinationRulesForTesting(tc.prevConfigs)
			}
			clusters, removed, delta := cg.DeltaClusters(proxy, tc.configUpdated,
				&model.WatchedResource{ResourceNames: tc.watchedResourceNames})
			if delta != tc.usedDelta {
				t.Errorf("un expected delta, want %v got %v", tc.usedDelta, delta)
			}
			assert.Equal(t, removed, tc.removedClusters)

				Type:        []string{"object"},
				Properties: map[string]spec.Schema{
					"resourceNames": {
						VendorExtensible: spec.VendorExtensible{
							Extensions: spec.Extensions{
								"x-kubernetes-list-type": "atomic",
							},
						},
						SchemaProps: spec.SchemaProps{

          "items": {
            "type": "string"
          },
          "type": "array",
          "x-kubernetes-list-type": "atomic"
        },
        "resourceNames": {
          "description": "ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.",
          "items": {
            "type": "string"
          },