Leonardo Sarra <******@****.***> 1718349751 +0200

Leonardo Sarra <******@****.***> 1718349751 +0200

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
 name: default
spec:
 selector:
   matchLabels:
     app: foo
 mtls:
   mode: STRICT
---`
	paDisable := `
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
 name: default
spec:
 selector:
   matchLabels:
     app: foo
 mtls:
   mode: DISABLE
---`
	paPermissive := `

apiVersion: release-notes/v2
kind: bug-fix
area: security
issue: [51556]
releaseNotes:
  - |

				// if the selectors do not match
				continue
			}
			// If both the destination rules are without a workload selector or with matching workload selectors, simply merge them.
			// If the incoming rule has a workload selector, it has to be merged with the existing rules with workload selector, and
			// at the same time added as a unique entry in the processedDestRules.

	configStore.Create(config.Config{
		Meta: config.Meta{
			Name:             "test",
			Namespace:        "default",
			GroupVersionKind: gvk.Telemetry,
		},
		Spec: &tpb.Telemetry{
			Selector: &v1beta1.WorkloadSelector{
				MatchLabels: map[string]string{
					"app": "test",
				},
			},
			AccessLogging: []*tpb.AccessLogging{
				{
					Providers: []*tpb.ProviderRef{
						{

		inputFiles: []string{"testdata/deprecation.yaml"},
		analyzer:   &deprecation.FieldAnalyzer{},
		expected: []message{
			{msg.Deprecated, "VirtualService foo/productpage"},
			{msg.Deprecated, "Sidecar default/no-selector"},
		},
	},
	{
		name:       "externalControlPlaneMissingWebhooks",
		inputFiles: []string{"testdata/externalcontrolplane-missing-urls.yaml"},
		analyzer:   &externalcontrolplane.ExternalControlPlaneAnalyzer{},

  annotations:
    {{- .Values.annotations | toYaml | nindent 4 }}
spec:
  {{- if not .Values.autoscaling.enabled }}
  {{- with .Values.replicaCount }}
  replicas: {{ . }}
  {{- end }}
  {{- end }}
  selector:
    matchLabels:
      {{- include "gateway.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      {{- with .Values.podAnnotations }}
      annotations:
        {{- toYaml . | nindent 8 }}

		pol := a.(*securityclient.PeerAuthentication)
		if pol.Namespace == meshCfg.GetRootNamespace() && pol.Spec.Selector == nil {
			return true
		}
		if pol.Namespace != ns {
			return false
		}
		sel := pol.Spec.Selector
		if sel == nil {
			return true // No selector matches everything
		}
		return labels.Instance(sel.MatchLabels).SubsetOf(matchLabels)
	}))
}

	if routes == nil || routes.Namespaces == nil || routes.Namespaces.Selector == nil {
		return nil
	}
	res := []string{}
	for k := range routes.Namespaces.Selector.MatchLabels {
		res = append(res, k)
	}
	for _, me := range routes.Namespaces.Selector.MatchExpressions {
		if me.Operator == metav1.LabelSelectorOpNotIn || me.Operator == metav1.LabelSelectorOpDoesNotExist {