workloadLabels := selectionOpts.WorkloadLabels
	namespace := selectionOpts.Namespace
	configs := make([]*config.Config, 0)
	var lookupInNamespaces []string
	if namespace != rootNamespace {
		// Only check the root namespace if the (workload) namespace is not already the root namespace
		// to avoid double inclusion.
		lookupInNamespaces = []string{namespace, rootNamespace}
	} else {
		lookupInNamespaces = []string{namespace}

      type: ResolvedRefs
    controllerName: istio.io/gateway-controller
    parentRef:
      name: gateway
      namespace: istio-system
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  creationTimestamp: null
  name: http-not-selected
  namespace: default
spec: null
status:
  parents:
  - conditions:
    - lastTransitionTime: fake

}

func createTestRequestAuthenticationResource(
	name string, namespace string, selector *selectorpb.WorkloadSelector, targetRef *selectorpb.PolicyTargetReference,
) *config.Config {
	ra := &config.Config{
		Meta: config.Meta{
			GroupVersionKind: gvk.RequestAuthentication,
			Name:             name,
			Namespace:        namespace,
		},
		Spec: &securityBeta.RequestAuthentication{},
	}

			PersistentVolumeSource: corev1.PersistentVolumeSource{
				ISCSI: &corev1.ISCSIPersistentVolumeSource{
					SecretRef: &corev1.SecretReference{
						Name:      "Spec.PersistentVolumeSource.ISCSI.SecretRef",
						Namespace: "iscsi"}}}}},
		{Spec: corev1.PersistentVolumeSpec{
			ClaimRef: &corev1.ObjectReference{Namespace: "claimrefns", Name: "claimrefname"},

		&compbasemetrics.CounterOpts{
			Namespace:      namespace,
			Name:           "cache_list_total",
			Help:           "Number of LIST requests served from watch cache",
			StabilityLevel: compbasemetrics.ALPHA,
		},
		[]string{"resource_prefix", "index"},
	)
	listCacheNumFetched = compbasemetrics.NewCounterVec(
		&compbasemetrics.CounterOpts{
			Namespace:      namespace,
			Name:           "cache_list_fetched_objects_total",

	return &ist
}

// GetAppNamespace gets echo app namespace instance.
func GetAppNamespace() namespace.Instance {
	return appNsInst
}

func GetIngressInstance() ingress.Instance {
	return ingInst
}

func GetZipkinInstance() zipkin.Instance {
	return zipkinInst
}

func TestSetup(ctx resource.Context) (err error) {
	appNsInst, err = namespace.New(ctx, namespace.Config{
		Prefix: "echo",
		Inject: true,
	})

// If the configmap is not found, it will be created.
// If the namespace is filtered out by discovery selector, the configmap will be deleted.
func (nc *NamespaceController) reconcileCACert(o types.NamespacedName) error {
	ns := o.Namespace
	if ns == "" {
		// For Namespace object, it will not have o.Namespace field set
		ns = o.Name
	}

		SetupParallel(
			namespace.Setup(&echo1NS, namespace.Config{Prefix: "echo1", Inject: true}),
			namespace.Setup(&serverNS, namespace.Config{Prefix: "servers", Inject: true}),
		).
		SetupParallel(
			jwt.Setup(&jwtServer, namespace.Future(&serverNS)),
			authz.Setup(&authzServer, namespace.Future(&serverNS)),
			authz.SetupLocal(&localAuthzServer, namespace.Future(&echo1NS)),

    kind: HTTPRoute
    namespace: istio-system
  to:
  - group: ""
    kind: Service
    name: echo
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
metadata:
  name: allowed-my-svc
  namespace: istio-system
spec:
  parentRefs:
  - name: gateway
    namespace: istio-system
    sectionName: my-svc
  rules:
  - backendRefs:
    - name: my-svc
      namespace: service
      port: 34000
---

        "name": "nameValue",
        "namespace": "namespaceValue"
      },
      "nodeStageSecretRef": {
        "name": "nameValue",
        "namespace": "namespaceValue"
      },
      "nodePublishSecretRef": {
        "name": "nameValue",
        "namespace": "namespaceValue"
      },
      "controllerExpandSecretRef": {
        "name": "nameValue",
        "namespace": "namespaceValue"
      },