allowedRoutes:
        namespaces:
          from: All
    - name: abc-foo-example-com
      port: 80
      protocol: HTTP
      hostname: "abc.foo.example.com"
      allowedRoutes:
        namespaces:
          from: All
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: attaches-to-empty-hostname-with-hostname-intersection
  namespace: gateway-conformance-infra
spec:

				APIGroup:          "",
				APIVersion:        "v1",
				Namespace:         "default",
				Resource:          "pods",
			}),
			expected: []MatchValue{{IndexName: FieldIndex("metadata.namespace"), Value: "default"}},
		},
		"Match field for listing namespace pods with metadata.namespace field selector": {
			labelSelector: "",
			fieldSelector: "metadata.namespace=kube-system",
			indexLabels:   []string{},

			return
		}
	}
	c.queue.Add(sa.Namespace)
}

// namespaceAdded reacts to a Namespace creation by creating a default ServiceAccount object
func (c *ServiceAccountsController) namespaceAdded(obj interface{}) {
	namespace := obj.(*v1.Namespace)
	c.queue.Add(namespace.Name)
}

// namespaceUpdated reacts to a Namespace update (or re-list) by creating a default ServiceAccount in the namespace if needed

kind: Gateway
metadata:
  name: gateway
  namespace: istio-system
spec:
  gatewayClassName: istio
  listeners:
  - name: default
    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:
        from: All
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: http
  namespace: default
spec:
  parentRefs:
  - name: gateway

				},
				namespace: "bar",
			},
			false,
		},
		{
			"source namespace not match when empty",
			args{
				match: &v1alpha3.TLSMatchAttributes{
					SourceNamespace: "foo",
				},
				namespace: "",
			},
			false,
		},
		{
			"source namespace any",
			args{
				match:     &v1alpha3.TLSMatchAttributes{},
				namespace: "bar",
			},
			true,
		},
	}

				Name:        "test",
				Namespace:   "test",
				Labels:      ambientEnabledLabel,
				Annotations: sidecarStatusAnnotation,
			},
		}
	)

	type args struct {
		namespace *corev1.Namespace
		pod       *corev1.Pod
	}
	tests := []struct {
		name string
		args args
		want bool
	}{
		{
			name: "ambient mode enabled for namespace",
			args: args{

apiVersion: v1
kind: Namespace
metadata:
  name: bookinfo
  labels:
    istio-injection: "enabled"
spec: {}
---
# Deployment should generate a warning: two services using that deployment
# using the same port but different protocol.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: multiple-svc-multiple-prot
  namespace: bookinfo
  labels:
    app: details
    version: v1
spec:
  replicas: 1
  selector:

				spiffe.Identity{TrustDomain: "cluster.local", Namespace: "namespace", ServiceAccount: "serviceaccount"}.String(),
			},
			sa:        "serviceaccount",
			namespace: "namespace",
			success:   true,
		},
		{
			name: "no match namespace",
			identity: []string{

			Name:      "name2",
			Namespace: "namespace",
		},
		Status: corev1.PodStatus{PodIP: "1.2.3.5"},
	}
	pc.CreateOrUpdateStatus(pod2)
	tt.WaitUnordered("add/namespace/name2")
	assert.Equal(t, Collection.Get(), ptr.Of("namespace/name,namespace/name2"))

	pc.Delete(pod.Name, pod.Namespace)
	pc.Delete(pod2.Name, pod2.Namespace)
	tt.WaitUnordered("delete/namespace/name", "delete/namespace/name2")

			systemNs, err = istio.ClaimSystemNamespace(ctx)
			return err
		}).
		Setup(namespace.Setup(&echoNS, namespace.Config{Prefix: "echo1", Inject: true})).
		SetupParallel(
			jwt.Setup(&jwtServer, namespace.Future(&systemNs)),
			deployment.SetupSingleNamespace(&apps, deployment.Config{
				Namespaces: []namespace.Getter{
					namespace.Future(&echoNS),
				},
			})).
		Run()
}