t.Errorf("unexpected create namespace action")
	}
}

func TestAdmissionWithLatentCache(t *testing.T) {
	namespace := "test"
	mockClient := newMockClientForTest([]string{})
	mockClient.AddReactor("create", "namespaces", func(action core.Action) (bool, runtime.Object, error) {
		return true, nil, errors.NewAlreadyExists(api.Resource("namespaces"), namespace)
	})

    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:
        from: Selector
        selector:
          matchLabels:
            kubernetes.io/metadata.name: banana
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: http
  namespace: apple
spec:
  parentRefs:
  - name: gateway
    namespace: istio-system
  rules:
  - backendRefs:
    - name: httpbin-apple

			namespace.Setup(&externalNS, namespace.Config{Prefix: "external", Inject: false})).
		SetupParallel(
			deployment.Setup(&apps, deployment.Config{
				Namespaces: []namespace.Getter{
					namespace.Future(&echo1NS),
					namespace.Future(&echo2NS),
					namespace.Future(&echo3NS),
				},
				ExternalNamespace: namespace.Future(&externalNS),
			})).
		Run()
}

		l.LogAndFatal(err)
	}

	// create watched namespaces
	namespaces := strings.Split(oiArgs.common.watchedNamespaces, ",")
	// if the namespace in the CR is provided, consider creating it too.
	if istioNamespace != "" {
		namespaces = append(namespaces, istioNamespace)
	}
	for _, ns := range namespaces {
		if err := operatorutil.CreateNamespace(kubeClient.Kube(), ns, "", opts.DryRun); err != nil {

	// only if either (a) this list contains that target namespace or
	// (b) this list contains "*".  Note that "*" matches any
	// specified namespace but does not match a request that _does
	// not specify_ a namespace (see the `clusterScope` field for
	// that).
	// This list may be empty, but only if `clusterScope` is true.
	// +optional
	// +listType=set

		s := rs.Message.(*v1alpha3.Sidecar)

		// record namespace-scoped sidecars
		if s.WorkloadSelector == nil || len(s.WorkloadSelector.Labels) == 0 {
			namespacesToSidecars[rs.Metadata.FullName.Namespace] = append(namespacesToSidecars[rs.Metadata.FullName.Namespace], rs)
			return true
		}

		sNs := rs.Metadata.FullName.Namespace
		sel := labels.SelectorFromSet(s.WorkloadSelector.Labels)

		foundPod := false

kind: Gateway
metadata:
  name: third-party-gateway
  namespace: istio-system
spec:
  addresses:
  - value: istio-ingressgateway
    type: Hostname
  gatewayClassName: third-party-gatewayclass
  listeners:
  - name: default
    hostname: "*.domain.example"
    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:
        from: All
---
apiVersion: gateway.networking.k8s.io/v1beta1

	}

	// try fetching the namespace-defined waypoint
	namespace := ptr.OrEmpty[*v1.Namespace](krt.FetchOne[*v1.Namespace](ctx, Namespaces, krt.FilterKey(o.Namespace)))
	// this probably should never be nil. How would o exist in a namespace we know nothing about? maybe edge case of starting the controller or ns delete?
	if namespace != nil {
		// toss isNone, we don't need to know /why/ we got nil

    - namespaces:
      - exact: only-l4-ns
      principals:
      - exact: only-l4-principals
- rules:
  - matches:
    - {}
  - matches:
    - {}
- rules:
  - matches:
    - namespaces:
      - exact: when-l4-l7-ns
  - matches:
    - {}
- rules:
  - matches:
    - namespaces:
      - exact: when-l4-ns
  - matches:
    - notSourceIps:
      - address: FBQUFA==
        length: 32

	// Only the first per-cluster entry for a given config should have a non-nil ref.
	refs []*echo.Instance
	// namespaces caches namespaces by their prefix; used for converting Static namespace from configs into actual
	// namespaces
	namespaces map[string]namespace.Instance
	// the set of injection templates for each cluster
	templates map[string]sets.String