return &nsMutex
}

// nsLock - provides primitives for locking critical namespace regions.
type nsLock struct {
	ref int32
	*lsync.LRWMutex
}

// nsLockMap - namespace lock map, provides primitives to Lock,
// Unlock, RLock and RUnlock.
type nsLockMap struct {
	// Indicates if namespace is part of a distributed setup.
	isDistErasure bool
	lockMap       map[string]*nsLock
	lockMapMutex  sync.Mutex

		Use:   "status",
		Short: "Show the status of waypoints in a namespace",
		Long:  "Show the status of waypoints for the namespace provided or default namespace if none is provided",
		Example: `  # Show the status of the waypoint in the default namespace
		 istioctl waypoint status
		  
		 # Show the status of the waypoint in a specific namespace
  		 istioctl waypoint status --namespace default`,

				drName, drNamespace, err := getIstioDestinationRuleNameForSvc(&cd, svc, port.Port)
				var dr *clientnetworking.DestinationRule
				if err == nil && drName != "" && drNamespace != "" {
					exist := false
					dr, exist = recordDestinationRules[newResourceID(drNamespace, drName)]
					if !exist {

	retval := make([]corev1.Namespace, 0, len(namespaces))
	seen := sets.String{}
	for _, webhook := range hook.Webhooks {
		nsSelector, err := metav1.LabelSelectorAsSelector(webhook.NamespaceSelector)
		if err != nil {
			return retval
		}

		for _, namespace := range namespaces {
			if !seen.Contains(namespace.Name) && nsSelector.Matches(api_pkg_labels.Set(namespace.Labels)) {

               },
               "expr": "sum by (cluster, namespace, job) (\n    rate(\n        process_cpu_seconds_total{\n            cluster=~\"$cluster\",\n            namespace=~\"$namespace\",\n            job=~\"$job\"\n        }\n    [$__rate_interval])\n)\n",
               "intervalFactor": 2,
               "legendFormat": "{{cluster}} - {{namespace}}\n"
            }
         ],
         "title": "CPU Usage",

			client.Istio().NetworkingV1().DestinationRules(t.Namespace).Create(context.TODO(), t, metav1.CreateOptions{})
		case *clientnetworking.Gateway:
			client.Istio().NetworkingV1().Gateways(t.Namespace).Create(context.TODO(), t, metav1.CreateOptions{})
		case *clientnetworking.VirtualService:
			client.Istio().NetworkingV1().VirtualServices(t.Namespace).Create(context.TODO(), t, metav1.CreateOptions{})
		}
	}

        "refresh": 1,

				nsLabels = ns.GetLabels()
			} else {
				namespace := ctx.NamespaceOrDefault(ctx.Namespace())
				ns, err := kubeClient.Kube().CoreV1().Namespaces().Get(context.TODO(), namespace, metav1.GetOptions{})
				if err != nil {
					return err
				}
				ls, err := metav1.ParseToLabelSelector(labelPairs)
				if err != nil {
					return err
				}
				podLabels = ls.MatchLabels
				nsLabels = ns.GetLabels()
			}

			namespace:     "",
			wantPodName:   "istio-security-post-install-1.2.2-bm9w2",
			wantNamespace: "istio-system",
		},
		{
			proxyName:     "service/istiod",
			namespace:     "",
			wantPodName:   "service/istiod",
			wantNamespace: "",
		},
		{
			proxyName:     "service/istiod",
			namespace:     "namespace",
			wantPodName:   "service/istiod",

  // specify a namespace (which happens either because the resource
  // is not namespaced or the request targets all namespaces).
  // If this field is omitted or false then the `namespaces` field
  // must contain a non-empty list.
  // +optional
  optional bool clusterScope = 4;

  // `namespaces` is a list of target namespaces that restricts