if !ecdsNeedsPush(req) {
		return nil, model.DefaultXdsLogDetails, nil
	}

	wasmSecrets := referencedSecrets(proxy, req.Push, w.ResourceNames)

	// When referenced configs are ONLY updated (like secret update), we should push
	// if the referenced config is relevant for ECDS. A secret update is relevant
	// only if it is referred via WASM plugin.

	}
	if w.ResourceNames == nil || len(w.ResourceNames) != 1 {
		return status.Error(codes.InvalidArgument, "exactly one debug request is required")
	}
	return nil
}

func parseAndValidateDebugRequest(proxy *model.Proxy, w *model.WatchedResource, dg *DebugGen) (string, error) {
	resourceName := w.ResourceNames[0]
	u, _ := url.Parse(resourceName)
	debugType := u.Path

        def packageNames = [ 'allowed.pkg1', 'allowed.pkg2' ]
        def resourceNames = [ 'allowed.resource1', 'allowed.resource2' ]
        def resourcePrefixes = [ 'allowed.resourcePrefix1.', 'allowed.resourcePrefix2.' ]
        return new FilteringClassLoader.Spec(classNames, packageNames, packagePrefixes, resourcePrefixes, resourceNames, disallowedClassNames, disallowedPackagePrefixes)
    }

    def visitableUrlClassloaderSpec() {

		// the internal book-keeping to subscribe to the Pods, so that we push updates to those Pods.
		w.ResourceNames = subs.Merge(have).UnsortedList()
	} else {
		// For wildcard, we record all resources that have been pushed and not removed
		// It was to correctly calculate removed resources during full push alongside with specific address removed.
		w.ResourceNames = subs.Merge(have).Difference(removed).UnsortedList()
	}

        List<String> packageNames = decodeStrings(decoder);
        List<String> resourceNames = decodeStrings(decoder);
        List<String> resourcePrefixes = decodeStrings(decoder);

        return new FilteringClassLoader.Spec(classNames, packageNames, packagePrefixes, resourcePrefixes, resourceNames, disallowedClassNames, disallowedPackagePrefixes);
    }

    - '*'
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: istio-sidecar-psp
rules:
  - apiGroups:
      - extensions
    resources:
      - podsecuritypolicies
    resourceNames:
      - istio-sidecar
    verbs:
      - use
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: istio-sidecar-psp
roleRef:
  apiGroup: rbac.authorization.k8s.io

      {
        "verbs": [
          "verbsValue"
        ],
        "apiGroups": [
          "apiGroupsValue"
        ],
        "resources": [
          "resourcesValue"
        ],
        "resourceNames": [
          "resourceNamesValue"
        ]
      }
    ],
    "nonResourceRules": [
      {
        "verbs": [
          "verbsValue"
        ],
        "nonResourceURLs": [

  },
  "rules": [
    {
      "verbs": [
        "verbsValue"
      ],
      "apiGroups": [
        "apiGroupsValue"
      ],
      "resources": [
        "resourcesValue"
      ],
      "resourceNames": [
        "resourceNamesValue"
      ],
      "nonResourceURLs": [
        "nonResourceURLsValue"
      ]
    }
  ],
  "aggregationRule": {
    "clusterRoleSelectors": [
      {

    uid: uidValue
  resourceVersion: resourceVersionValue
  selfLink: selfLinkValue
  uid: uidValue
rules:
- apiGroups:
  - apiGroupsValue
  nonResourceURLs:
  - nonResourceURLsValue
  resourceNames:
  - resourceNamesValue
  resources:
  - resourcesValue
  verbs:

  },
  "rules": [
    {
      "verbs": [
        "verbsValue"
      ],
      "apiGroups": [
        "apiGroupsValue"
      ],
      "resources": [
        "resourcesValue"
      ],
      "resourceNames": [
        "resourceNamesValue"
      ],
      "nonResourceURLs": [
        "nonResourceURLsValue"
      ]
    }
  ],
  "aggregationRule": {
    "clusterRoleSelectors": [
      {