if err != nil {
		t.Fatal(err)
	}
	return i
}

// Ingresses returns all ingresses for "istio-ingressgateway" in each cluster.
func Ingresses(ctx resource.Context) (ingress.Instances, error) {
	i, err := Get(ctx)
	if err != nil {
		return nil, err
	}
	return i.Ingresses(), nil
}

// IngressesOrFail calls Ingresses and fails if an error is encountered.

				"extensions/v1beta1/ingresses": "false",
			},
			defaultResourceConfig: func() *serverstore.ResourceConfig {
				return newFakeAPIResourceConfigSource()
			},
			expectedAPIConfig: func() *serverstore.ResourceConfig {
				config := newFakeAPIResourceConfigSource()
				config.DisableResources(extensionsapiv1beta1.SchemeGroupVersion.WithResource("ingresses"))
				return config
			},

				{GroupResource: schema.GroupResource{Group: "extensions", Resource: "ingresses"}},
			},
			expected: []ResourceInfo{
				{GroupResource: schema.GroupResource{Group: "", Resource: "nodes"}},
				{GroupResource: schema.GroupResource{Group: "", Resource: "pods"}},
				{GroupResource: schema.GroupResource{Group: "extensions", Resource: "ingresses"}},

        "delete",
        "deletecollection",
        "get",
        "list",
        "patch",
        "update",
        "watch"
      ]
    },
    {
      "kind": "Ingress",
      "name": "ingresses",
      "namespaced": true,
      "shortNames": [
        "ing"
      ],
      "singularName": "ingress",
      "storageVersionHash": "39NQlfNR+bo=",
      "verbs": [
        "create",
        "delete",

	if shouldProcess {
		// record processed ingress
		c.mutex.Lock()
		c.ingresses[item] = ing
		c.mutex.Unlock()
		return true
	}

	c.mutex.Lock()
	_, preProcessed := c.ingresses[item]
	// previous processed but should not currently, delete it
	if preProcessed && !shouldProcess {
		delete(c.ingresses, item)
	} else {
		c.ingresses[item] = ing
	}
	c.mutex.Unlock()

	return preProcessed
}

  resources: ["ingresses"]
  verbs: ["get", "list", "watch"]
# For now, GLBC annotates ingress resources with various state and statuses:
# https://github.com/kubernetes/ingress-gce/blob/50d49b077d9ab4362a02fae05f94e433cd3f08dc/pkg/controller/controller.go#L579
# TODO(rramkumar1): Remove unnecessary `update` permission once statuses are propagated through `ingresses/status`
- apiGroups: ["extensions", "networking.k8s.io"]

	s.queue.Run(stopCh)
	controllers.ShutdownAll(s.services, s.nodes, s.pods, s.ingressClasses, s.ingresses)
}

// NewStatusSyncer creates a new instance
func NewStatusSyncer(meshHolder mesh.Watcher, kc kubelib.Client) *StatusSyncer {
	c := &StatusSyncer{
		meshConfig:     meshHolder,
		ingresses:      kclient.NewFiltered[*knetworking.Ingress](kc, kclient.Filter{ObjectFilter: kc.ObjectFilter()}),

	// For example, extensions.ingresses and networking.k8s.io.ingresses share
	// the same underlying storage. Without sorting, in an HA cluster, one
	// apiserver may dedup and update StorageVersion for extensions.ingresses,
	// while another apiserver may dedup and update StorageVersion for
	// networking.k8s.io.ingresses. The storage migrator (which migrates objects

    resources: ["ingresses"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["extensions", "networking.k8s.io"]
    resources: ["ingresses/status"]
    verbs: ["*"]
{{- end}}
  - apiGroups: ["networking.k8s.io"]
    resources: ["ingresses", "ingressclasses"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["networking.k8s.io"]
    resources: ["ingresses/status"]
    verbs: ["*"]

    resources: ["ingresses"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["extensions", "networking.k8s.io"]
    resources: ["ingresses/status"]
    verbs: ["*"]
{{- end}}
  - apiGroups: ["networking.k8s.io"]
    resources: ["ingresses", "ingressclasses"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["networking.k8s.io"]
    resources: ["ingresses/status"]
    verbs: ["*"]