String namespace = dis.readUTF();
            String name = dis.readUTF();
            return new NamespaceId(namespace, name);
        } catch (Exception e) {
            throw new RuntimeException("Failed decoding namespace ID");
        }
    }

    public NamespaceId(String namespace, String name) {
        this.namespace = namespace;
        this.name = name;
    }

{
  "apiVersion": "v1",
  "groupVersion": "discovery.k8s.io/v1",
  "kind": "APIResourceList",
  "resources": [
    {
      "kind": "EndpointSlice",
      "name": "endpointslices",
      "namespaced": true,
      "singularName": "endpointslice",
      "storageVersionHash": "qgS0xkrxYAI=",
      "verbs": [
        "create",
        "delete",
        "deletecollection",
        "get",
        "list",
        "patch",

{
  "apiVersion": "v1",
  "groupVersion": "storage.k8s.io/v1alpha1",
  "kind": "APIResourceList",
  "resources": [
    {
      "kind": "VolumeAttributesClass",
      "name": "volumeattributesclasses",
      "namespaced": false,
      "shortNames": [
        "vac"
      ],
      "singularName": "volumeattributesclass",
      "storageVersionHash": "HPC8kMG1ukQ=",
      "verbs": [
        "create",
        "delete",

type BindingAccessor interface {
	GetName() string
	GetNamespace() string

	// GetPolicyName returns the name of the (Validating/Mutating)AdmissionPolicy,
	// which is cluster-scoped, so namespace is usually left blank.
	// But we leave the door open to add a namespaced vesion in the future
	GetPolicyName() types.NamespacedName
	GetParamRef() *v1.ParamRef

	GetMatchResources() *v1.MatchResources

              value: "istio-test-namespace1,istio-test-namespace2"
            - name: LEADER_ELECTION_NAMESPACE
              value: "operator-test-namespace"
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: OPERATOR_NAME
              value: "operator-test-namespace"
            - name: WAIT_FOR_RESOURCES_TIMEOUT

              value: "istio-test-namespace1,istio-test-namespace2"
            - name: LEADER_ELECTION_NAMESPACE
              value: "operator-test-namespace"
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: OPERATOR_NAME
              value: "operator-test-namespace"
            - name: WAIT_FOR_RESOURCES_TIMEOUT

	cache.SharedIndexInformer
	Lister[T]
}

// Lister[T] helps list Ts.
// All objects returned here must be treated as read-only.
type Lister[T any] interface {
	NamespacedLister[T]
	Namespaced(namespace string) NamespacedLister[T]

}

// RoleBinding references a role, but does not contain it.  It can reference a Role in the same namespace or a ClusterRole in the global namespace.
// It adds who information via Subjects and namespace information by which namespace it exists in.  RoleBindings in a given
// namespace only have effect in that namespace.
message RoleBinding {
  // Standard object's metadata.
  // +optional

func (refs AllowedReferences) SecretAllowed(resourceName string, namespace string) bool {
	p, err := creds.ParseResourceName(resourceName, "", "", "")
	if err != nil {
		log.Warnf("failed to parse resource name %q: %v", resourceName, err)
		return false
	}
	from := Reference{Kind: gvk.KubernetesGateway, Namespace: k8s.Namespace(namespace)}
	to := Reference{Kind: gvk.Secret, Namespace: k8s.Namespace(p.Namespace)}
	allow := refs[from][to]
	if allow == nil {

			Reason:  metav1.StatusReasonNotFound,
			Message: fmt.Sprintf("%s not found", name),
		}}
	}
	result = obj.(T)
	return result, nil
}

func (w lister[T]) Namespaced(namespace string) NamespacedLister[T] {
	return namespacedLister[T]{namespace: namespace, indexer: w.indexer}
}

func NewLister[T runtime.Object](indexer cache.Indexer) lister[T] {
	return lister[T]{indexer: indexer}