// Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding.
  // Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"),  but not both.
  // +optional
  // +listType=atomic
  repeated string nonResourceURLs = 5;
}

  // Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding.
  // Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"),  but not both.
  // +optional
  // +listType=atomic
  repeated string nonResourceURLs = 6;
}

  group: install.istio.io
  names:
    kind: IstioOperator
    listKind: IstioOperatorList
    plural: istiooperators
    singular: istiooperator
    shortNames:
    - iop
    - io
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - description: Istio control plane revision
      jsonPath: .spec.revision
      name: Revision
      type: string
    - description: IOP current state

	ResponseKind *v1.GroupVersionKind `json:"responseKind,omitempty" protobuf:"bytes,2,opt,name=responseKind"`
	// scope indicates the scope of a resource, either Cluster or Namespaced
	Scope ResourceScope `json:"scope" protobuf:"bytes,3,opt,name=scope"`
	// singularResource is the singular name of the resource.  This allows clients to handle plural and singular opaquely.

apiVersion: v1
kind: Namespace
metadata:
  name: injection-disabled-ns
spec: {}
---
# Deployment has multiple service attached but using same port but different protocol.
# Sidecar is enabled although the namespaced doesn't have automatic injection.
# It should generate a warning.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ann-enabled-ns-disabled
  namespace: injection-disabled-ns
  labels:

	defer iv.mu.Unlock()
	if iv.patternsByNamespace[namespace] == nil {
		iv.patternsByNamespace[namespace] = sets.String{}
	}
	iv.patternsByNamespace[namespace].Insert(pattern)
}

// ShouldIgnore checks if a given namespaced name should be ignored based on the patterns.
func (iv *ValidationIgnorer) ShouldIgnore(namespace, name string) bool {
	iv.mu.RLock()
	defer iv.mu.RUnlock()

	patterns, exists := iv.patternsByNamespace[namespace]

	if err != nil {
		return false, err
	}

	for _, resource := range resourceList.APIResources {
		if resource.Name == gvr.Resource {
			return resource.Namespaced, nil
		}
	}

	return false, fmt.Errorf("resource %q not found", gvr.String())

  optional .k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind responseKind = 2;

  // scope indicates the scope of a resource, either Cluster or Namespaced
  optional string scope = 3;

  // singularResource is the singular name of the resource.  This allows clients to handle plural and singular opaquely.

  optional k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind responseKind = 2;

  // scope indicates the scope of a resource, either Cluster or Namespaced
  optional string scope = 3;

  // singularResource is the singular name of the resource.  This allows clients to handle plural and singular opaquely.

	namespace, name, err = cache.SplitMetaNamespaceKey(key)
	if err != nil {
		utilruntime.HandleError(fmt.Errorf("invalid resource key: %s", key))
		return nil
	}

	if len(namespace) > 0 {
		lister = c.informer.Namespaced(namespace)
	} else {
		lister = c.informer
	}

	newObj, err = lister.Get(name)
	if err != nil {
		if !kerrors.IsNotFound(err) {
			return err
		}