v1beta1.LabelServiceName: name,
	}).AsSelectorPreValidated().Add(*endpointSliceRequirement)
}

func (esc *endpointSliceController) pushEDS(hostnames []host.Name, namespace string) {
	shard := model.ShardKeyFromRegistry(esc.c)
	// Even though we just read from the cache, we need the full lock to ensure pushEDS
	// runs sequentially when `EnableK8SServiceSelectWorkloadEntries` is enabled. Otherwise,

	// This can happen if a ServiceEntry's resolution is changed from STATIC to DNS which changes the Envoy cluster type from
	// EDS to STRICT_DNS or LOGICAL_DNS. When pushEds is called before Envoy sends the updated cluster list via Endpoint request which in turn
	// will update "Connection.Clusters", we might accidentally send EDS updates for STRICT_DNS cluster. This check guards

	matchedHostnames := slices.Map(matchedServices, func(e *v1.Service) host.Name {
		return kube.ServiceHostname(e.Name, e.Namespace, c.opts.DomainSuffix)
	})
	c.endpoints.pushEDS(matchedHostnames, si.Namespace)
}

func (c *Controller) onSystemNamespaceEvent(_, ns *v1.Namespace, ev model.Event) error {
	if ev == model.EventDelete {
		return nil
	}
	if c.setNetworkFromNamespace(ns) {