lock                sync.RWMutex
	namespaces          kclient.Client[*corev1.Namespace]
	discoveryNamespaces sets.String
	discoverySelectors  []labels.Selector // nil if discovery selectors are not specified, permits all namespaces for discovery
	handlers            []func(added, removed sets.String)
}

func NewDiscoveryNamespacesFilter(
	namespaces kclient.Client[*corev1.Namespace],
	mesh mesh.Watcher,
	stop <-chan struct{},

	}

	// try fetching the namespace-defined waypoint
	namespace := ptr.OrEmpty[*v1.Namespace](krt.FetchOne[*v1.Namespace](ctx, Namespaces, krt.FilterKey(o.Namespace)))
	// this probably should never be nil. How would o exist in a namespace we know nothing about? maybe edge case of starting the controller or ns delete?
	if namespace != nil {
		// toss isNone, we don't need to know /why/ we got nil

		return nil
	}
	namespaces := []string{}
	for _, ns := range r.Namespaces {
		if ls.Matches(toNamespaceSet(ns.Name, ns.Labels)) {
			namespaces = append(namespaces, ns.Name)
		}
	}
	// Ensure stable order
	sort.Strings(namespaces)
	return namespaces
}

func nilOrEqual(have *string, expected string) bool {
	return have == nil || *have == expected
}

func humanReadableJoin(ss []string) string {

			var waypointAddress *workloadapi.GatewayAddress
			// Endpoint does not have a real ObjectMeta, so make one
			if !implicitEndpoints {
				if waypoint := fetchWaypointForWorkload(ctx, Waypoints, Namespaces, metav1.ObjectMeta{
					Name:      se.Name,
					Namespace: se.Namespace,
					Labels:    wle.Labels,
				}); waypoint != nil {

	}}})
	testns := clienttest.NewWriter[*corev1.Namespace](t, c)
	discoveryNamespacesFilter := filter.NewDiscoveryNamespacesFilter(
		kclient.New[*corev1.Namespace](c),
		meshWatcher,
		test.NewStop(t),
	)
	namespaces := kclient.NewFiltered[*corev1.Namespace](c, kubetypes.Filter{
		ObjectFilter: discoveryNamespacesFilter,
	})
	c.RunAndWait(test.NewStop(t))

		var namespaces []string
		for k := range namespaceToServices {
			namespaces = append(namespaces, k)
		}
		// If namespace is omitted, return successfully if there is only one such host name in the service index.
		if len(namespaces) == 1 {
			svc := namespaceToServices[namespaces[0]]
			hostname = string(svc.Hostname)

	Name         string          `json:"name"`
	Namespace    string          `json:"namespace"`
	Hostname     string          `json:"hostname"`
	Addresses    []string        `json:"vips"`
	Ports        map[string]int  `json:"ports"`
	LoadBalancer *LoadBalancer   `json:"loadBalancer"`
	Waypoint     *GatewayAddress `json:"waypoint"`
}

type PolicyMatch struct {
	Namespaces          []StringMatch `json:"namespaces,omitempty"`

type AffinityTerm struct {
	Namespaces        sets.Set[string]
	Selector          labels.Selector
	TopologyKey       string
	NamespaceSelector labels.Selector
}

// Matches returns true if the pod matches the label selector and namespaces or namespace selector.
func (at *AffinityTerm) Matches(pod *v1.Pod, nsLabels labels.Set) bool {
	if at.Namespaces.Has(pod.Namespace) || at.NamespaceSelector.Matches(nsLabels) {

					Namespace: spl[1],
					Name:      spl[0],
				})
			}
		}
	}
	switch variant {
	case "httproute":
		return tmpl.MustEvaluate(`apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: "{{.Namespace}}{{.Match | replace "*" "wild"}}{{.Dest}}"
  namespace: {{.Namespace}}
  creationTimestamp: "{{.Time}}"
spec:

		},
		analyzer: &injection.ImageAnalyzer{},
		expected: []message{
			{msg.PodsIstioProxyImageMismatchInNamespace, "Namespace enabled-namespace"},
			{msg.PodsIstioProxyImageMismatchInNamespace, "Namespace enabled-namespace-native"},
			{msg.PodsIstioProxyImageMismatchInNamespace, "Namespace revision-namespace"},
		},
	},
	{
		name:       "portNameNotFollowConvention",
		inputFiles: []string{"testdata/service-no-port-name.yaml"},