// we only need to authorize the parsed group/version
			apiGroup = gv.Group
			apiVersion = gv.Version
			if gvr, err := v.resourceResolver.Resolve(gv.WithKind(paramKind.Kind)); err == nil {
				// we only need to authorize the resolved resource
				resource = gvr.Resource
			}
		}
	}

	var attrs authorizer.AttributesRecord

	paramRef := binding.Spec.ParamRef
	verb := "get"

			"Entries":     inp.Entries,
			"PackageName": "gvk",
		}),
		writeTemplate("pkg/config/schema/gvr/resources.gen.go", gvrTemplate, map[string]any{
			"Entries":     gvrEntries,
			"PackageName": "gvr",
		}),
		writeTemplate("pilot/pkg/config/kube/crdclient/types.gen.go", crdclientTemplate, map[string]any{
			"Entries":     inp.Entries,
			"Packages":    inp.Packages,

	}

	return c.dispatcher.Dispatch(ctx, a, o, c.source.Hooks())
}

func (c *Plugin[H]) shouldIgnoreResource(attr admission.Attributes) bool {
	gvr := attr.GetResource()
	// exclusion decision ignores the version.
	gr := gvr.GroupResource()
	return c.excludedResources.Has(gr)

	"k8s.io/apimachinery/pkg/runtime/schema"
	"k8s.io/apimachinery/pkg/types"
	"sigs.k8s.io/gateway-api/pkg/consts"

	"istio.io/istio/pilot/pkg/features"
	"istio.io/istio/pkg/config/schema/gvr"
	"istio.io/istio/pkg/kube"
	"istio.io/istio/pkg/kube/controllers"
	"istio.io/istio/pkg/kube/kubetypes"
	"istio.io/istio/pkg/log"
)

type crdWatcher struct {
	crds      Informer[*metav1.PartialObjectMetadata]

	client discovery.DiscoveryInterface
}

func (d *discoveryResourceResolver) Resolve(gvk schema.GroupVersionKind) (schema.GroupVersionResource, error) {
	gv := gvk.GroupVersion()
	// TODO: refactor this into an efficient gvk --> gvr resolver that remembers hits and re-resolves group/version info on misses
	resources, err := d.client.ServerResourcesForGroupVersion(gv.String())
	if err != nil {
		return schema.GroupVersionResource{}, err
	}

	"istio.io/istio/pkg/typemap"
)

func MustGVRFromType[T runtime.Object]() schema.GroupVersionResource {
	if gk, ok := getGvk(ptr.Empty[T]()); ok {
		gr, ok := gvk.ToGVR(gk)
		if !ok {
			panic(fmt.Sprintf("unknown GVR for GVK %v", gk))
		}
		return gr
	}
	if rp := typemap.Get[RegisterType[T]](registeredTypes); rp != nil {
		return (*rp).GetGVR()
	}
	panic("unknown kind: " + ptr.TypeName[T]())
}

type ComparableObject interface {
	comparable
	Object
}

// IsNil works around comparing generic types
func IsNil[O ComparableObject](o O) bool {
	var t O
	return o == t
}

// UnstructuredToGVR extracts the GVR of an unstructured resource. This is useful when using dynamic
// clients.
func UnstructuredToGVR(u unstructured.Unstructured) (schema.GroupVersionResource, error) {
	res := schema.GroupVersionResource{}

		scope.Debugf("retrieving config for status update: %s/%s", resource.Namespace, resource.Name)
		k, ok := gvk.FromGVR(resource.GroupVersionResource)
		if !ok {
			scope.Warnf("GVR %v could not be identified", resource.GroupVersionResource)
			return nil
		}

		current := store.Get(k, resource.Name, resource.Namespace)
		return current
	}
	return &Manager{
		store:   store,

	"istio.io/istio/pkg/config/schema/ast"
	"istio.io/istio/pkg/test/env"
	"istio.io/istio/pkg/util/sets"
)

//go:embed templates/gvk.go.tmpl
var gvkTemplate string

//go:embed templates/gvr.go.tmpl
var gvrTemplate string

//go:embed templates/crdclient.go.tmpl
var crdclientTemplate string

//go:embed templates/types.go.tmpl
var typesTemplate string

//go:embed templates/clients.go.tmpl

	}()
	return h
}

// NewInformer creates a Collection[I] sourced from
// the results of kube.Client querying resources of type I
// from the API Server.
//
// Resources must have their GVR and GVK registered in the
// kube.Client before this method is called, otherwise
// NewInformer will panic.
func NewInformer[I controllers.ComparableObject](c kube.Client, opts ...CollectionOption) Collection[I] {