var policyGVKs = []config.GroupVersionKind{
	gvk.AuthorizationPolicy,
	gvk.RequestAuthentication,
	gvk.Telemetry,
	gvk.WasmPlugin,
}

type policy interface {
	GetSelector() *typev1beta1.WorkloadSelector
	GetTargetRef() *typev1beta1.PolicyTargetReference
}

func (w *SelectorAnalyzer) Metadata() analysis.Metadata {
	return analysis.Metadata{
		Name:        "k8sgateway.SelectorAnalyzer",

Rajat Sharma <******@****.***> 1681308406 +0200

  namespace: default
spec:
  workloadSelector:
    labels:
      app: productpage # Maps to an existing workload without conflicts in the same ns, no error
  egress:
  - hosts:
    - "./*"
---
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: maps-to-nonexistent
  namespace: default
spec:
  workloadSelector:
    labels:

			Hosts: []string{"*.google.com"},
			Ports: []*networking.ServicePort{
				{Number: 80, Name: "http-number", Protocol: "http"},
				{Number: 8080, Name: "http2-number", Protocol: "http2"},
			},
			WorkloadSelector: &networking.WorkloadSelector{
				Labels: map[string]string{"app": "foo"},
			},
		},
	}
	se2 := config.Config{
		Meta: config.Meta{GroupVersionKind: gvk.ServiceEntry, Namespace: "default", Name: "se-2"},

  name: test-remove-4
  namespace: bookinfo
spec:
  workloadSelector:
    labels:
      app: mysvc1
  configPatches:
  - applyTo: NETWORK_FILTER # http connection manager is a filter in Envoy
    match:
    patch:

---
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: test-remove-5
  namespace: bookinfo
spec:
  workloadSelector:
    labels:
      app: mysvc1
  configPatches:

	selector := &selectorpb.WorkloadSelector{
		MatchLabels: map[string]string{
			"app":     "httpbin",
			"version": "v1",
		},
	}
	configs = append(configs, createTestRequestAuthenticationResource("default", rootNamespace, nil, nil),
		createTestRequestAuthenticationResource("global-with-selector", rootNamespace, &selectorpb.WorkloadSelector{
			MatchLabels: map[string]string{

		// record namespace-scoped sidecars
		if s.WorkloadSelector == nil || len(s.WorkloadSelector.Labels) == 0 {
			namespacesToSidecars[rs.Metadata.FullName.Namespace] = append(namespacesToSidecars[rs.Metadata.FullName.Namespace], rs)
			return true
		}

		sNs := rs.Metadata.FullName.Namespace
		sel := labels.SelectorFromSet(s.WorkloadSelector.Labels)

		foundPod := false

		Kind:  gvk.Service.Kind,
		Name:  "sample-svc",
	}
	sampleSelector := &v1beta1.WorkloadSelector{
		MatchLabels: labels.Instance{
			"app": "my-app",
		},
	}
	sampleGatewaySelector := &v1beta1.WorkloadSelector{
		MatchLabels: labels.Instance{
			constants.GatewayNameLabel: "sample-gateway",
		},
	}
	sampleWaypointSelector := &v1beta1.WorkloadSelector{
		MatchLabels: labels.Instance{
			constants.GatewayNameLabel: "sample-waypoint",

	workloadSelector string, credentialName string, clientNamespace namespace.Instance,
) {
	args := map[string]any{
		"to":               to,
		"Mode":             destinationRuleMode,
		"CredentialName":   credentialName,
		"WorkloadSelector": workloadSelector,
	}
	se := `
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: filter-ratelimit
  namespace: istio-system
spec:
  workloadSelector:
    # select by label in the same namespace
    labels:
      istio: ingressgateway
  configPatches:
    # The Envoy config you want to modify
    - applyTo: HTTP_FILTER
      match:
        context: GATEWAY
        listener:
          filterChain:
            filter: