matchingSvcs := make([]ServiceSpecWithName, 0)
	d := r.Message.(*appsv1.DeploymentSpec)
	deploymentNS := r.Metadata.FullName.Namespace.String()

	c.ForEach(gvk.Service, func(r *resource.Instance) bool {
		s := r.Message.(*core_v1.ServiceSpec)

		sSelector := klabels.SelectorFromSet(s.Selector)
		pLabels := klabels.Set(d.Template.Labels)

// Package-wide variables from generator "generated".
option go_package = "k8s.io/api/node/v1beta1";

// Overhead structure represents the resource overhead associated with running a pod.
message Overhead {
  // podFixed represents the fixed resource overhead associated with running a pod.
  // +optional
  map<string, k8s.io.apimachinery.pkg.api.resource.Quantity> podFixed = 1;
}

message ClusterTrustBundle {
  // metadata contains the object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // spec contains the signer (if any) and trust anchors.
  optional ClusterTrustBundleSpec spec = 2;
}

// ClusterTrustBundleList is a collection of ClusterTrustBundle objects
message ClusterTrustBundleList {

apiVersion: gateway.networking.k8s.io/v1beta1
kind: GatewayClass
metadata:
  creationTimestamp: null
  name: istio
  namespace: default
spec: null
status:
  conditions:
  - lastTransitionTime: fake
    message: Handled by Istio controller
    reason: Accepted
    status: "True"
    type: Accepted
  supportedFeatures:
  - HTTPRouteFeatureA
  - HTTPRouteFeatureB
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway

		if s.Code() == codes.Canceled || s.Code() == codes.DeadlineExceeded {
			return true
		}
		if s.Code() == codes.Unavailable && containsExpectedMessage(s.Message()) {
			return true
		}
	}
	// If this is not a gRPCStatus we should just error message.
	if strings.Contains(err.Error(), "stream terminated by RST_STREAM with error code: NO_ERROR") {
		return true
	}

		}
	}

	c.ForEach(gvk.ValidatingWebhookConfiguration, func(resource *resource.Instance) bool {
		webhookConfig := resource.Message.(*v1.ValidatingWebhookConfiguration)

		// 1. ValidatingWebhookConfiguration: istio-validator or istiod-default-validator(default)

// accept a name or number.
// TODO: Rename to Int32OrString
//
// +protobuf=true
// +protobuf.options.(gogoproto.goproto_stringer)=false
// +k8s:openapi-gen=true
message IntOrString {
  optional int64 type = 1;

  optional int32 intVal = 2;

  optional string strVal = 3;

			}
		}
	}
}

func applyDelta(message model.Resources, resp *discovery.DeltaDiscoveryResponse) model.Resources {
	deleted := sets.New(resp.RemovedResources...)
	byName := map[string]*discovery.Resource{}
	for _, v := range resp.Resources {
		byName[v.Name] = v
	}
	res := model.Resources{}
	for _, m := range message {
		if deleted.Contains(m.Name) {
			continue
		}

)

// TestDestinationRuleTls tests that MUTUAL tls mode is respected in DestinationRule.
// This sets up a client and server with appropriate cert config and ensures we can successfully send a message.
func TestDestinationRuleTls(t *testing.T) {
	framework.
		NewTest(t).
		Run(func(t framework.TestContext) {
			ns := appNS

		}
		if tc.expectedErrMsg != "" {
			if err == nil {
				t.Errorf("Case %q: no error message returned: want %s", id, tc.expectedErrMsg)
			} else if tc.expectedErrMsg != err.Error() {
				t.Errorf("Case %q: unexpected error message: want %s but got %s", id, tc.expectedErrMsg, err.Error())
			}
		}
	}