apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio-injection: enabled
  name: enabled-namespace
---
# Namespace 'enabled-namespace-2' has istio injection enabled, so will be enforced.
apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio-injection: enabled
  name: enabled-namespace-2
---
# Details-v1-pod-old is out of date and should get a warning.
apiVersion: v1
kind: Pod
metadata:
  labels:

			putLabeledObject(key("pod-1", "namespace-2"), labels("a", "1")),
			putSelectingObject(key("hpa-1", "namespace-2"), selector("a", "1")),
		},
		want: []expectation{
			forwardSelect(key("hpa-1", "namespace-1")), // selects nothing
			forwardSelect(key("hpa-1", "namespace-2"), key("pod-1", "namespace-2")),
			reverseSelect(key("pod-1", "namespace-1")), // selects nothing

# Migration from istio-system

Istio 1.0 includes the gateways in istio-system. Since the external IP is associated
with the Service and bound to the namespace, it is recommended to:

1. Install the new gateway in a new namespace.
2. Copy any TLS certificate to the new namespace, and configure the domains.
3. Checking the new gateway work - for example by overriding the IP in /etc/hosts
4. Modify the DNS server to add the A record of the new namespace

# Migration from istio-system

Istio 1.0 includes the gateways in istio-system. Since the external IP is associated
with the Service and bound to the namespace, it is recommended to:

1. Install the new gateway in a new namespace.
2. Copy any TLS certificate to the new namespace, and configure the domains.
3. Checking the new gateway work - for example by overriding the IP in /etc/hosts
4. Modify the DNS server to add the A record of the new namespace

enum Version {
  NOT_USED = 0;
  V1 = 1;
}

message ZdsHello {
  Version version = 1;
}

message WorkloadInfo {
  reserved "trust_domain"; // Deprecated
  reserved 4;
  string name = 1;
  string namespace = 2;
  string service_account = 3;
}

// Add a workload to the ztunnel. this will be accompanied by ancillary data contianing
// the workload's netns file descriptor.
message AddWorkload {
  string uid = 1;

syntax = "proto3";

package istio.security;
option go_package="pkg/workloadapi/security";

import "google/protobuf/empty.proto";

message Authorization {
  string name = 1;
  string namespace = 2;

  // Determine the scope of this RBAC policy.
  // If set to NAMESPACE, the 'namespace' field value will be used.
  Scope scope = 3;
  // The action to take if the request is matched with the rules.

message Service {
  // Name represents the name for the service.
  // For Kubernetes, this is the Service name.
  string name = 1;
  // Namespace represents the namespace for the service.
  string namespace = 2;
  // Hostname represents the FQDN of the service.
  // For Kubernetes, this would be <name>.<namespace>.svc.<cluster domain>.
  // TODO: support this field
  string hostname = 3;

kind: VirtualService
metadata:
  annotations:
    internal.istio.io/parents: HTTPRoute/bind-cross-namespace.group-namespace1,HTTPRoute/bind-cross-namespace.group-namespace2
    internal.istio.io/route-semantics: gateway
  creationTimestamp: null
  name: bind-cross-namespace-2-istio-autogenerated-k8s-gateway
  namespace: group-namespace1
spec:
  gateways:
  - istio-system/gateway-istio-autogenerated-k8s-gateway-slctr-labels
  hosts:

	"k8s.io/apimachinery/pkg/selection"
	"k8s.io/apimachinery/pkg/util/validation"
	"k8s.io/kubernetes/pkg/apis/core/helper"
)

// IsExtendedResourceName returns true if:
// 1. the resource name is not in the default namespace;
// 2. resource name does not have "requests." prefix,
// to avoid confusion with the convention in quota
// 3. it satisfies the rules in IsQualifiedName() after converted into quota resource name

	t.Helper()
	// Testing of Blackhole and Passthrough clusters:
	// Setup of environment:
	// 1. client and destination are deployed to app-1-XXXX namespace
	// 2. client is restricted to talk to destination via Sidecar scope where outbound policy is set (ALLOW_ANY, REGISTRY_ONLY)
	//    and clients' egress can only be to service-2-XXXX/* and istio-system/*