},
				},
				{
					Meta: config.Meta{
						GroupVersionKind: gvk.RequestAuthentication,
						Name:             "with-targetref",
						Namespace:        "foo",
					},
					Spec: &securityBeta.RequestAuthentication{
						TargetRef: &selectorpb.PolicyTargetReference{
							Group: gvk.KubernetesGateway.Group,
							Kind:  gvk.KubernetesGateway.Kind,
							Name:  "my-gateway",
						},
					},
				},

		return gvk.ConfigMap, true
	case *k8sioapiextensionsapiserverpkgapisapiextensionsv1.CustomResourceDefinition:
		return gvk.CustomResourceDefinition, true
	case *k8sioapiappsv1.DaemonSet:
		return gvk.DaemonSet, true
	case *k8sioapiappsv1.Deployment:
		return gvk.Deployment, true
	case *istioioapinetworkingv1alpha3.DestinationRule:
		return gvk.DestinationRule, true
	case *apiistioioapinetworkingv1alpha3.DestinationRule:

	"istio.io/istio/pkg/config"
	"istio.io/istio/pkg/config/schema/gvk"
	"istio.io/istio/pkg/ptr"
	"istio.io/istio/pkg/typemap"
)

func MustGVRFromType[T runtime.Object]() schema.GroupVersionResource {
	if gk, ok := getGvk(ptr.Empty[T]()); ok {
		gr, ok := gvk.ToGVR(gk)
		if !ok {
			panic(fmt.Sprintf("unknown GVR for GVK %v", gk))
		}
		return gr
	}

				}
			},
		},
		{
			name:        "error determining gvk",
			metaFactory: stubMetaFactory{err: errors.New("test")},
			assertOnError: func(t *testing.T, err error) {
				if err == nil || err.Error() != "test" {
					t.Errorf("expected error \"test\", got: %v", err)
				}
			},
		},
		{
			name:        "typer does not recognize into",
			gvk:         &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},

	}

	var buf bytes.Buffer
	for gvk := range legacyscheme.Scheme.AllKnownTypes() {
		if nonRoundTrippableTypes.Has(gvk.Kind) {
			continue
		}
		if gvk.Version == runtime.APIVersionInternal {
			continue
		}

		subtestName := fmt.Sprintf("%s.%s/%s", gvk.Version, gvk.Group, gvk.Kind)
		if gvk.Group == "" {
			subtestName = fmt.Sprintf("%s/%s", gvk.Version, gvk.Kind)
		}

	if orig.GroupVersionKind != mod.GroupVersionKind {
		return nil, fmt.Errorf("gvk mismatch: %v, modified: %v", orig.GroupVersionKind, mod.GroupVersionKind)
	}
	switch orig.GroupVersionKind {
{{- range .Entries }}
	{{- if and (not .Resource.Synthetic) (not .Resource.Builtin) }}
	case gvk.{{.Resource.Identifier}}:
		oldRes := &{{ .IstioAwareClientImport }}.{{ .Resource.Kind }}{
				ObjectMeta: origMeta,

func (fa *AlphaAnalyzer) Analyze(ctx analysis.Context) {
	ctx.ForEach(gvk.Namespace, func(r *resource.Instance) bool {
		fa.allowAnnotations(r, ctx, gvk.Namespace)
		return true
	})
	ctx.ForEach(gvk.Service, func(r *resource.Instance) bool {
		fa.allowAnnotations(r, ctx, gvk.Service)
		return true
	})
	ctx.ForEach(gvk.Pod, func(r *resource.Instance) bool {
		fa.allowAnnotations(r, ctx, gvk.Pod)
		return true
	})

			"match at least one pod, and that there aren't multiple sidecar resources that select overlapping pods",
		Inputs: []config.GroupVersionKind{
			gvk.Sidecar,
			gvk.Pod,
			gvk.Namespace,
		},
	}
}

// Analyze implements Analyzer
func (a *SelectorAnalyzer) Analyze(c analysis.Context) {
	podsToSidecars := make(map[resource.FullName][]*resource.Instance)

		Description: "Checks if caCertificates is set when TLS mode is SIMPLE/MUTUAL",
		Inputs: []config.GroupVersionKind{
			gvk.DestinationRule,
		},
	}
}

func (c *CaCertificateAnalyzer) Analyze(ctx analysis.Context) {
	ctx.ForEach(gvk.DestinationRule, func(r *resource.Instance) bool {
		c.analyzeDestinationRule(r, ctx)
		return true
	})
}

			if err != nil {
				c.Report(gvk.ValidatingWebhookConfiguration, msg.NewInvalidExternalControlPlaneConfig(r, *clientConf.URL, hName, err.Error()))
				return
			}
			if result.isIP() {
				c.Report(gvk.ValidatingWebhookConfiguration, msg.NewExternalControlPlaneAddressIsNotAHostname(r, *clientConf.URL, hName))
			}
		} else if clientConf.Service == nil {