FieldSelector: "metadata.name=" + CACertNamespaceConfigMap,
		ObjectFilter:  kube.FilterIfEnhancedFilteringEnabled(kubeClient),
	})
	c.namespaces = kclient.NewFiltered[*v1.Namespace](kubeClient, kclient.Filter{
		ObjectFilter: kube.FilterIfEnhancedFilteringEnabled(kubeClient),
	})
	// kube-system is not skipped to enable deploying ztunnel in that namespace

		extraFilter = of.ObjectFilter.Filter
	}

	var namespaceFilter kubetypes.DynamicObjectFilter
	if !s.IsClusterScoped() {
		namespaceFilter = kube.FilterIfEnhancedFilteringEnabled(cl.client)
	}
	filter := kubetypes.Filter{ObjectFilter: composeFilters(namespaceFilter, cl.inRevision, extraFilter)}

	var kc kclient.Untyped
	if s.IsBuiltin() {

		if port, err := strconv.Atoi(v); err == nil {
			return port
		}
	}
	return 15014
}

// FilterIfEnhancedFilteringEnabled returns the namespace filter if EnhancedResourceScoping is enabled, otherwise a NOP filter.
func FilterIfEnhancedFilteringEnabled(k Client) kubetypes.DynamicObjectFilter {
	if features.EnableEnhancedResourceScoping {
		return k.ObjectFilter()
	}
	return nil

	webhookConfig func() inject.WebhookConfig, injectionHandler func(fn func()), tw revisions.TagWatcher, revision string,
) *DeploymentController {
	filter := kclient.Filter{ObjectFilter: kube.FilterIfEnhancedFilteringEnabled(client)}
	gateways := kclient.NewFiltered[*gateway.Gateway](client, filter)
	gatewayClasses := kclient.New[*gateway.GatewayClass](client)
	dc := &DeploymentController{
		client:    client,