ResponseKind *v1.GroupVersionKind `json:"responseKind,omitempty" protobuf:"bytes,2,opt,name=responseKind"`
	// scope indicates the scope of a resource, either Cluster or Namespaced
	Scope ResourceScope `json:"scope" protobuf:"bytes,3,opt,name=scope"`
	// singularResource is the singular name of the resource.  This allows clients to handle plural and singular opaquely.

func ruleMatchesResource(r *audit.PolicyRule, attrs authorizer.Attributes) bool {
	if !attrs.IsResourceRequest() {
		return false
	}

	if len(r.Namespaces) > 0 {
		if !hasString(r.Namespaces, attrs.GetNamespace()) { // Non-namespaced resources use the empty string.
			return false
		}
	}
	if len(r.Resources) == 0 {
		return true
	}

	apiGroup := attrs.GetAPIGroup()

# limitations under the License.
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: serviceimports.{{ .Group }}
spec:
  group: {{ .Group }}
  scope: Namespaced
  names:
    plural: serviceimports
    singular: serviceimport
    kind: ServiceImport
    shortNames:
    - svcim
  versions:
  - name: {{ .Version }}
    served: true
    storage: true

          imagePullPolicy: IfNotPresent
---
apiVersion: v1
kind: Namespace
metadata:
  name: injection-disabled-ns
spec: {}
---
# Deployment has multiple service attached but using same port but different protocol.
# Sidecar is enabled although the namespaced doesn't have automatic injection.
# It should generate a warning.
apiVersion: apps/v1
kind: Deployment
metadata:

# isolated tests. It should be possible to also apply it to real k8s.

# TODO: the IP addresses are not namespaced yet, so must be unique on the mesh (flat namespace) including in
# ServiceEntry tests. Removing deps on ip in progress.
---
# Default sidecar
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: default
  namespace: none
spec:
  egress:
    - hosts:
        - none/*

		vi.Add(parts[0], parts[1])
	}
	return vi
}

func (iv *ValidationIgnorer) Add(namespace, pattern string) {
	iv.mu.Lock()
	defer iv.mu.Unlock()
	if iv.patternsByNamespace[namespace] == nil {
		iv.patternsByNamespace[namespace] = sets.String{}
	}
	iv.patternsByNamespace[namespace].Insert(pattern)
}

// ShouldIgnore checks if a given namespaced name should be ignored based on the patterns.

	// prevent deletion of immortal namespaces
	if a.GetOperation() == admission.Delete && a.GetKind().GroupKind() == v1.SchemeGroupVersion.WithKind("Namespace").GroupKind() && l.immortalNamespaces.Has(a.GetName()) {
		return errors.NewForbidden(a.GetResource().GroupResource(), a.GetName(), fmt.Errorf("this namespace may not be deleted"))
	}

	// always allow non-namespaced resources

)

const (
	// this name is guaranteed to be not present in the cluster as it not a valid namespace name
	fakeSVMNamespaceName          string = "@fake:svm_ns!"
	ResourceVersionControllerName string = "resource-version-controller"
)

// ResourceVersionController adds the resource version obtained from a randomly nonexistent namespace
// to the SVM status before the migration is initiated. This resource version is utilized for checking

	var newObj T
	var err error
	var namespace string
	var name string
	var lister NamespacedLister[T]

	// Convert the namespace/name string into a distinct namespace and name
	namespace, name, err = cache.SplitMetaNamespaceKey(key)
	if err != nil {
		utilruntime.HandleError(fmt.Errorf("invalid resource key: %s", key))
		return nil
	}

	if len(namespace) > 0 {
		lister = c.informer.Namespaced(namespace)

# Namespaced and data- attributes

Attributes with a namespace are treated as if they had no namespace.
Given the excerpt

	<a my:href="{{.}}"></a>

At parse time the attribute will be treated as if it were just "href".
So at parse time the template becomes:

	<a my:href="{{. | urlescaper | attrescaper}}"></a>

Similarly to attributes with namespaces, attributes with a "data-" prefix are