var policyGVKs = []config.GroupVersionKind{
	gvk.AuthorizationPolicy,
	gvk.RequestAuthentication,
	gvk.Telemetry,
	gvk.WasmPlugin,
}

type policy interface {
	GetSelector() *typev1beta1.WorkloadSelector
	GetTargetRef() *typev1beta1.PolicyTargetReference
}

func (w *SelectorAnalyzer) Metadata() analysis.Metadata {
	return analysis.Metadata{
		Name:        "k8sgateway.SelectorAnalyzer",

Rajat Sharma <******@****.***> 1681308406 +0200

			Hosts: []string{"*.google.com"},
			Ports: []*networking.ServicePort{
				{Number: 80, Name: "http-number", Protocol: "http"},
				{Number: 8080, Name: "http2-number", Protocol: "http2"},
			},
			WorkloadSelector: &networking.WorkloadSelector{
				Labels: map[string]string{"app": "foo"},
			},
		},
	}
	se2 := config.Config{
		Meta: config.Meta{GroupVersionKind: gvk.ServiceEntry, Namespace: "default", Name: "se-2"},

	selector := &selectorpb.WorkloadSelector{
		MatchLabels: map[string]string{
			"app":     "httpbin",
			"version": "v1",
		},
	}
	configs = append(configs, createTestRequestAuthenticationResource("default", rootNamespace, nil, nil),
		createTestRequestAuthenticationResource("global-with-selector", rootNamespace, &selectorpb.WorkloadSelector{
			MatchLabels: map[string]string{

		// record namespace-scoped sidecars
		if s.WorkloadSelector == nil || len(s.WorkloadSelector.Labels) == 0 {
			namespacesToSidecars[rs.Metadata.FullName.Namespace] = append(namespacesToSidecars[rs.Metadata.FullName.Namespace], rs)
			return true
		}

		sNs := rs.Metadata.FullName.Namespace
		sel := labels.SelectorFromSet(s.WorkloadSelector.Labels)

		foundPod := false

		Kind:  gvk.Service.Kind,
		Name:  "sample-svc",
	}
	sampleSelector := &v1beta1.WorkloadSelector{
		MatchLabels: labels.Instance{
			"app": "my-app",
		},
	}
	sampleGatewaySelector := &v1beta1.WorkloadSelector{
		MatchLabels: labels.Instance{
			constants.GatewayNameLabel: "sample-gateway",
		},
	}
	sampleWaypointSelector := &v1beta1.WorkloadSelector{
		MatchLabels: labels.Instance{
			constants.GatewayNameLabel: "sample-waypoint",

	workloadSelector string, credentialName string, clientNamespace namespace.Instance,
) {
	args := map[string]any{
		"to":               to,
		"Mode":             destinationRuleMode,
		"CredentialName":   credentialName,
		"WorkloadSelector": workloadSelector,
	}
	se := `
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: filter-ratelimit
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      app: clt
  configPatches:
    # The Envoy config you want to modify
    - applyTo: HTTP_FILTER
      match:
        context: SIDECAR_OUTBOUND
        listener:
          filterChain:
            filter:
              name: "envoy.filters.network.http_connection_manager"

  namespace: ns1
spec:
  egress:
  - hosts:
    - "./*"
---
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: has-selector
  namespace: ns1
spec:
  workloadSelector: # Since this has a workload selector, it shouldn't conflict with the other Sidecar in the namespace
    labels:
      app: foo
  egress:
  - hosts:
    - "./*"
---
apiVersion: networking.istio.io/v1alpha3

apiVersion: release-notes/v2
kind: bug-fix
area: istioctl  
issue:
- 51567
releaseNotes:
- |