"name": "validatingadmissionpolicies/status",
      "namespaced": false,
      "singularName": "",
      "verbs": [
        "get",
        "patch",
        "update"
      ]
    },
    {
      "categories": [
        "api-extensions"
      ],
      "kind": "ValidatingAdmissionPolicyBinding",
      "name": "validatingadmissionpolicybindings",
      "namespaced": false,

      "name": "validatingadmissionpolicies/status",
      "namespaced": false,
      "singularName": "",
      "verbs": [
        "get",
        "patch",
        "update"
      ]
    },
    {
      "categories": [
        "api-extensions"
      ],
      "kind": "ValidatingAdmissionPolicyBinding",
      "name": "validatingadmissionpolicybindings",
      "namespaced": false,

// (ref: https://github.com/torvalds/linux/commit/13b287e8d1cad951634389f85b8c9b816bd3bb1e)
const TCPKeepAliveTimeNamespacedKernelVersion = "4.5"

// TCPKeepAliveIntervalNamespacedKernelVersion is the kernel version in which net.ipv4.tcp_keepalive_intvl was namespaced(netns).

      "name": "validatingadmissionpolicies/status",
      "namespaced": false,
      "singularName": "",
      "verbs": [
        "get",
        "patch",
        "update"
      ]
    },
    {
      "categories": [
        "api-extensions"
      ],
      "kind": "ValidatingAdmissionPolicyBinding",
      "name": "validatingadmissionpolicybindings",
      "namespaced": false,

	ResponseKind *v1.GroupVersionKind `json:"responseKind,omitempty" protobuf:"bytes,2,opt,name=responseKind"`
	// scope indicates the scope of a resource, either Cluster or Namespaced
	Scope ResourceScope `json:"scope" protobuf:"bytes,3,opt,name=scope"`
	// singularResource is the singular name of the resource.  This allows clients to handle plural and singular opaquely.

# Namespaced and data- attributes

Attributes with a namespace are treated as if they had no namespace.
Given the excerpt

	<a my:href="{{.}}"></a>

At parse time the attribute will be treated as if it were just "href".
So at parse time the template becomes:

	<a my:href="{{. | urlescaper | attrescaper}}"></a>

Similarly to attributes with namespaces, attributes with a "data-" prefix are

	namespaces, err := namespace.GetAll(t)
	if err != nil {
		return fmt.Errorf("failed retrieving list of namespaces: %v", err)
	}

	// Restrict egress from this namespace to only those endpoints in the same Echos.
	cfg := t.ConfigIstio().New()
	cfg.Eval(ns.Name(), map[string]any{
		"Namespaces": namespaces,
	}, `
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: restrict-to-namespace
spec:

	lock                sync.RWMutex
	namespaces          kclient.Client[*corev1.Namespace]
	discoveryNamespaces sets.String
	discoverySelectors  []labels.Selector // nil if discovery selectors are not specified, permits all namespaces for discovery
	handlers            []func(added, removed sets.String)
}

func NewDiscoveryNamespacesFilter(
	namespaces kclient.Client[*corev1.Namespace],
	mesh mesh.Watcher,
	stop <-chan struct{},

	if _, err := c.Kube().CoreV1().Namespaces().Create(context.TODO(), &corev1.Namespace{
		ObjectMeta: metav1.ObjectMeta{
			Name:   n.name,
			Labels: createNamespaceLabels(n.ctx, cfg),
		},
	}, metav1.CreateOptions{}); err != nil {
		return err
	}

	if !cfg.SkipCleanup {
		n.addCleanup(func() error {
			return c.Kube().CoreV1().Namespaces().Delete(context.TODO(), n.name, kube2.DeleteOptionsForeground())

}

func (a *index) serviceEntryServiceBuilder(
	Waypoints krt.Collection[Waypoint],
	Namespaces krt.Collection[*v1.Namespace],
) krt.TransformationMulti[*networkingclient.ServiceEntry, model.ServiceInfo] {
	return func(ctx krt.HandlerContext, s *networkingclient.ServiceEntry) []model.ServiceInfo {
		waypoint := fetchWaypointForService(ctx, Waypoints, Namespaces, s.ObjectMeta)