)

// IsInternalGatewayReference returns true if gatewayName is referencing the internal
// Istio Gateway corresponding to a Kubernetes Gateway API gateway.
func IsInternalGatewayReference(gatewayName string) bool {
	parts := strings.SplitN(gatewayName, "/", 2)
	if len(parts) == 2 {
		gatewayName = parts[1]
	}
	return strings.Contains(gatewayName, fmt.Sprintf("-%s-", constants.KubernetesGatewayName))
}

	}
	return portMatch
}

func isGatewayMatch(gateway string, gatewayNames []string) bool {
	// if there's no gateway predicate, gatewayMatch is true; otherwise we match against the gateways for this workload
	if len(gatewayNames) == 0 {
		return true
	}
	if len(gatewayNames) > 0 {
		for _, gatewayName := range gatewayNames {
			if gatewayName == gateway {
				return true
			}
		}
	}
	return false

						s.Name, gatewayName)
				}
			}
			if s.Port == nil {
				// Should be rejected in validation, this is an extra check
				log.Debugf("invalid server without port: %q", gatewayName)
				RecordRejectedConfig(gatewayName)
				continue
			}
			sanitizeServerHostNamespace(s, gatewayConfig.Namespace)
			gatewayNameForServer[s] = gatewayName

	}
	return targetRefs
}

func (p WorkloadPolicyMatcher) ShouldAttachPolicy(kind config.GroupVersionKind, policyName types.NamespacedName, policy TargetablePolicy) bool {
	gatewayName, isGatewayAPI := workloadGatewayName(p.WorkloadLabels)
	targetRefs := GetTargetRefs(policy)

	// non-gateway: use selector
	if !isGatewayAPI {
		// if targetRef is specified, ignore the policy altogether

			wantHosts: []string{"rule2gw.com", "rule3gw.com"},
			gateway:   gatewayName,
		},
		{
			proxyNs:   "test2",
			wantHosts: []string{"rule2gw.com", "rule3gw.com"},
			gateway:   gatewayName,
		},
		{
			proxyNs:   "ns1",
			wantHosts: []string{"rule2gw.com", "rule3gw.com"},
			gateway:   gatewayName,
		},
		{
			proxyNs:   "random",
			wantHosts: []string{"rule3gw.com"},

						// Matching gateways from vs.spec.gateways
						for _, gatewayName := range vs.Spec.Gateways {
							if gatewayName == "" || gatewayName == analyzerutil.MeshGateway {
								continue
							}
							// parse gateway
							gns := vsNamespace
							parts := strings.SplitN(gatewayName, "/", 2)
							if len(parts) == 2 {
								gatewayName = parts[1]
								gns = parts[0]
							}

}

func validateGatewayNames(gatewayNames []string, gatewaySemantics bool) (errs Validation) {
	for _, gatewayName := range gatewayNames {
		parts := strings.SplitN(gatewayName, "/", 2)
		if len(parts) != 2 {
			if strings.Contains(gatewayName, ".") {
				// Legacy FQDN style
				parts := strings.Split(gatewayName, ".")
				recommended := fmt.Sprintf("%s/%s", parts[1], parts[0])

	)
}

// NewInvalidGatewayCredential returns a new diag.Message based on InvalidGatewayCredential.
func NewInvalidGatewayCredential(r *resource.Instance, gatewayName string, gatewayNamespace string) diag.Message {
	return diag.NewMessage(
		InvalidGatewayCredential,
		r,
		gatewayName,
		gatewayNamespace,
	)
}

// NewGatewayPortNotDefinedOnService returns a new diag.Message based on GatewayPortNotDefinedOnService.

ablePolicyChecks":true,"enableHelmTest":false,"enableTracing":true,"enabled":true,"hub":"docker.io/istio","imagePullPolicy":"IfNotPresent","imagePullSecrets":[],"istioNamespace":"istio-system","k8sIngress":{"enableHttps":false,"enabled":false,"gatewayName":"ingressgateway"},"localityLbSetting":{"enabled":true},"logAsJson":false,"logging":{"level":"default:info"},"meshExpansion":{"enabled":false,"useILB":false},"meshNetworks":{},"mtls":{"auto":false,"enabled":false},"multiCluster":{"clusterName":...

ablePolicyChecks":true,"enableHelmTest":false,"enableTracing":true,"enabled":true,"hub":"docker.io/istio","imagePullPolicy":"IfNotPresent","imagePullSecrets":[],"istioNamespace":"istio-system","k8sIngress":{"enableHttps":false,"enabled":false,"gatewayName":"ingressgateway"},"localityLbSetting":{"enabled":true},"logAsJson":false,"logging":{"level":"default:info"},"meshExpansion":{"enabled":false,"useILB":false},"meshNetworks":{},"mtls":{"auto":false,"enabled":false},"multiCluster":{"clusterName":...