return &nsMutex
}

// nsLock - provides primitives for locking critical namespace regions.
type nsLock struct {
	ref int32
	*lsync.LRWMutex
}

// nsLockMap - namespace lock map, provides primitives to Lock,
// Unlock, RLock and RUnlock.
type nsLockMap struct {
	// Indicates if namespace is part of a distributed setup.
	isDistErasure bool
	lockMap       map[string]*nsLock
	lockMapMutex  sync.Mutex

	namespace := o.GetName()
	labels := o.GetLabels()
	matchAmbient := labels[constants.DataplaneModeLabel] == constants.DataplaneModeAmbient
	if matchAmbient {
		log.Infof("Namespace %s is enabled in ambient mesh", namespace)
	} else {
		log.Infof("Namespace %s is disabled from ambient mesh", namespace)
	}
	for _, pod := range s.pods.List(namespace, klabels.Everything()) {

				return fmt.Errorf("failed to create Kubernetes client: %v", err)
			}
			ns := ctx.NamespaceOrDefault(ctx.Namespace())
			// If a user decides to enroll their namespace with a waypoint, verify that they have labeled their namespace as ambient.
			// If they don't, the user will be warned and be presented with the command to label their namespace as ambient if they
			// choose to do so.
			//

						"WARNING: Proxy is stale; it references to non-existent destination rule %s.%s\n",
						drName, drNamespace)
				}
			}

			vsName, vsNamespace, err := getIstioVirtualServiceNameForSvc(&cd, svc, port.Port)
			if err == nil && vsName != "" && vsNamespace != "" {
				vs, _ := configClient.NetworkingV1alpha3().VirtualServices(vsNamespace).Get(context.Background(), vsName, metav1.GetOptions{})
				if vs != nil {

	fs.AssertExpectations(t)

	// unlabelling the namespace should cause only one RemovePodFromMesh to happen
	fs.On("RemovePodFromMesh",
		ctx,
		mock.Anything,
	).Once().Return(nil)

	// unlabel the namespace
	labelsPatch := []byte(fmt.Sprintf(`{"metadata":{"labels":{"%s":null}}}`,
		constants.DataplaneModeLabel))
	_, err = client.Kube().CoreV1().Namespaces().Patch(ctx, ns.Name,

below can handle this for you. Replace `RELEASE` and `NAMESPACE` with the name and namespace of the release: ```console KINDS=(service deployment) RELEASE=istio-ingressgateway NAMESPACE=istio-system for KIND in "${KINDS[@]}"; do kubectl --namespace $NAMESPACE --overwrite=true annotate $KIND $RELEASE meta.helm.sh/release-name=$RELEASE kubectl --namespace $NAMESPACE --overwrite=true annotate $KIND $RELEASE meta.helm.sh/release-namespace=$NAMESPACE kubectl --namespace $NAMESPACE --overwrite=true label...

  // specify a namespace (which happens either because the resource
  // is not namespaced or the request targets all namespaces).
  // If this field is omitted or false then the `namespaces` field
  // must contain a non-empty list.
  // +optional
  optional bool clusterScope = 4;

  // `namespaces` is a list of target namespaces that restricts

  // specify a namespace (which happens either because the resource
  // is not namespaced or the request targets all namespaces).
  // If this field is omitted or false then the `namespaces` field
  // must contain a non-empty list.
  // +optional
  optional bool clusterScope = 4;

  // `namespaces` is a list of target namespaces that restricts

	retval := make([]corev1.Namespace, 0, len(namespaces))
	seen := sets.String{}
	for _, webhook := range hook.Webhooks {
		nsSelector, err := metav1.LabelSelectorAsSelector(webhook.NamespaceSelector)
		if err != nil {
			return retval
		}

		for _, namespace := range namespaces {
			if !seen.Contains(namespace.Name) && nsSelector.Matches(api_pkg_labels.Set(namespace.Labels)) {

			client.Istio().NetworkingV1alpha3().DestinationRules(t.Namespace).Create(context.TODO(), t, metav1.CreateOptions{})
		case *v1alpha3.Gateway:
			client.Istio().NetworkingV1alpha3().Gateways(t.Namespace).Create(context.TODO(), t, metav1.CreateOptions{})
		case *v1alpha3.VirtualService:
			client.Istio().NetworkingV1alpha3().VirtualServices(t.Namespace).Create(context.TODO(), t, metav1.CreateOptions{})
		}
	}