delegate cache.ResourceEventHandler,
) *Index[K, O] {
	idx := Index[K, O]{
		objects: make(map[K]sets.Set[types.NamespacedName]),
		client:  client,
		mu:      sync.RWMutex{},
	}
	addObj := func(obj any) {
		ro := controllers.ExtractObject(obj)
		o := ro.(O)
		objectKey := config.NamespacedName(o)
		for _, indexKey := range extract(o) {
			sets.InsertOrNew(idx.objects, indexKey, objectKey)
		}
	}

		).Get()
		res := sets.New[types.NamespacedName]()
		if accounts == "" {
			return res
		}
		for _, v := range strings.Split(accounts, ",") {
			ns, sa, valid := strings.Cut(v, "/")
			if !valid {
				log.Warnf("Invalid CA_TRUSTED_NODE_ACCOUNTS, ignoring: %v", v)
				continue
			}
			res.Insert(types.NamespacedName{
				Namespace: ns,
				Name:      sa,
			})
		}
		return res

type WorkArgs struct {
	NamespacedName types.NamespacedName
}

// KeyFromWorkArgs creates a key for the given `WorkArgs`
func (w *WorkArgs) KeyFromWorkArgs() string {
	return w.NamespacedName.String()
}

// NewWorkArgs is a helper function to create new `WorkArgs`
func NewWorkArgs(name, namespace string) *WorkArgs {
	return &WorkArgs{
		NamespacedName: types.NamespacedName{Namespace: namespace, Name: name},
	}
}

	for index, namespacedName := range apps.Ns1.All.NamespacedNames() {
		switch {
		case namespacedName.Name == "client":
			client = apps.Ns1.All[index]
		case namespacedName.Name == "server":
			server = apps.Ns1.All[index]
		case namespacedName.Name == "internal-client":
			internalClient = apps.Ns1.All[index]
		}
	}
	for index, namespacedName := range apps.Ns2.All.NamespacedNames() {

	return q
}

// Add an item to the queue.
func (q Queue) Add(item any) {
	q.queue.Add(item)
}

// AddObject takes an Object and adds the types.NamespacedName associated.
func (q Queue) AddObject(obj Object) {
	q.queue.Add(config.NamespacedName(obj))
}

// Run the queue. This is synchronous, so should typically be called in a goroutine.
func (q Queue) Run(stop <-chan struct{}) {
	defer q.queue.ShutDown()

	handles := atomic.NewInt32(0)
	q := NewQueue("custom", WithReconciler(func(key types.NamespacedName) error {
		handles.Inc()
		return nil
	}))
	q.Add(types.NamespacedName{Name: "something"})
	stop := make(chan struct{})
	go q.Run(stop)
	retry.UntilOrFail(t, q.HasSynced, retry.Delay(time.Microsecond))
	assert.Equal(t, handles.Load(), 1)
	q.Add(types.NamespacedName{Name: "something else"})
	close(stop)

type MulticlusterNodeAuthorizor struct {
	trustedNodeAccounts sets.Set[types.NamespacedName]
	component           *multicluster.Component[*ClusterNodeAuthorizer]
}

func NewMulticlusterNodeAuthenticator(
	trustedNodeAccounts sets.Set[types.NamespacedName],
	controller multicluster.ComponentBuilder,
) *MulticlusterNodeAuthorizor {
	m := &MulticlusterNodeAuthorizor{

func podKeyByProxy(proxy *model.Proxy) types.NamespacedName {
	parts := strings.Split(proxy.ID, ".")
	if len(parts) == 2 && proxy.Metadata.Namespace == parts[1] {
		return types.NamespacedName{Name: parts[0], Namespace: parts[1]}
	}

	return types.NamespacedName{}
}

func namespacedNameForService(svc *model.Service) types.NamespacedName {
	return types.NamespacedName{
		Namespace: svc.Attributes.Namespace,

	go queue.Run(test.NewStop(t))
	retry.UntilOrFail(t, queue.HasSynced)
	queue.Add(types.NamespacedName{Name: "success"})
	retry.UntilOrFail(t, func() bool { return success.Load() == 1 })
	queue.Add(types.NamespacedName{Name: "conflict-success"})
	retry.UntilOrFail(t, func() bool { return success.Load() == 2 && retries.Load() == 5 })
	queue.Add(types.NamespacedName{Name: "conflict-for-ever"})
	retries.Store(1)

	Annotations map[string]string           `json:"annotations"`
	Spec        *authpb.AuthorizationPolicy `json:"spec"`
}

func (ap *AuthorizationPolicy) NamespacedName() types.NamespacedName {
	return types.NamespacedName{Name: ap.Name, Namespace: ap.Namespace}
}

// AuthorizationPolicies organizes AuthorizationPolicy by namespace.
type AuthorizationPolicies struct {