ResourceType string
	// Name is the name of the secret
	Name string
	// Namespace is the namespace the secret resides in. For implicit namespace references (such as in KubernetesSecretType),
	// this will be resolved to the appropriate namespace. As a result, this should never be empty.
	Namespace string
	// ResourceName is the original name of the resource
	ResourceName string

		"Istio system namespace")
	return r
}

// Namespace returns the namespace flag value.
func (r *RootFlags) Namespace() string {
	return *r.namespace
}

// IstioNamespace returns the istioNamespace flag value.
func (r *RootFlags) IstioNamespace() string {
	return *r.istioNamespace
}

// DefaultNamespace returns the default namespace to use.
func (r *RootFlags) DefaultNamespace() string {

	PluginName = "NamespaceLifecycle"
	// how long a namespace stays in the force live lookup cache before expiration.
	forceLiveLookupTTL = 30 * time.Second
	// how long to wait for a missing namespace before re-checking the cache (and then doing a live lookup)
	// this accomplishes two things:
	// 1. It allows a watch-fed cache time to observe a namespace creation event
	// 2. It allows time for a namespace creation to distribute to members of a storage cluster,

			resource:         "kubernetes-gateway://namespace/cert",
			defaultNamespace: "default",
			expected: SecretResource{
				ResourceType: KubernetesGatewaySecretType,
				Name:         "cert",
				Namespace:    "namespace",
				ResourceName: "kubernetes-gateway://namespace/cert",
				Cluster:      "config",
			},
		},
		{
			name:             "kubernetes-gateway without namespace",
			resource:         "kubernetes-gateway://cert",

)

// NamespaceDiscoveryHandler is to handle namespace selected or deselected because of discoverySelectors change,
// rather than namespace add/update/delete event triggered from namespace informer.
func (s *Controller) NamespaceDiscoveryHandler(namespace string, event model.Event) {
	if event == model.EventDelete {
		log.Debugf("Handle event namespace %s deselected", namespace)
	} else {

      type: ResolvedRefs
    controllerName: istio.io/gateway-controller
    parentRef:
      name: gateway
      namespace: istio-system
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  creationTimestamp: null
  name: http-not-selected
  namespace: default
spec: null
status:
  parents:
  - conditions:
    - lastTransitionTime: fake

		&compbasemetrics.CounterOpts{
			Namespace:      namespace,
			Name:           "cache_list_total",
			Help:           "Number of LIST requests served from watch cache",
			StabilityLevel: compbasemetrics.ALPHA,
		},
		[]string{"resource_prefix", "index"},
	)
	listCacheNumFetched = compbasemetrics.NewCounterVec(
		&compbasemetrics.CounterOpts{
			Namespace:      namespace,
			Name:           "cache_list_fetched_objects_total",

{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user":"kubelet",   "namespace": "*",              "resource": "pods",                       "readonly": true }}

			namespace:     "",
			wantPodName:   "istio-security-post-install-1.2.2-bm9w2",
			wantNamespace: "istio-system",
		},
		{
			proxyName:     "service/istiod",
			namespace:     "",
			wantPodName:   "service/istiod",
			wantNamespace: "",
		},
		{
			proxyName:     "service/istiod",
			namespace:     "namespace",
			wantPodName:   "service/istiod",

apiVersion: v1
kind: Pod
metadata:
  labels:
    app: productpage
  name: productpage
  namespace: default
---
apiVersion: v1
kind: Pod
metadata:
  labels:
    app: productpage
  name: productpage-other
  namespace: other
---
apiVersion: v1
kind: Pod
metadata:
  labels:
    app: reviews
  name: reviews
  namespace: default
---
apiVersion: v1
kind: Pod
metadata:
  labels:
    app: ratings-app