namespace.Dump(ctx, ns)
					}
				}
			})
			csuite, err := suite.NewConformanceTestSuite(opts)
			assert.NoError(t, err)
			csuite.Setup(t, tests.ConformanceTests)

			// remove the dataplane mode label from the gateway-conformance-infra namespace
			// so that the ingress gateway doesn't get captured
			ns, err := namespace.Claim(ctx, namespace.Config{

	workloadLabels := selectionOpts.WorkloadLabels
	namespace := selectionOpts.Namespace
	configs := make([]*config.Config, 0)
	var lookupInNamespaces []string
	if namespace != rootNamespace {
		// Only check the root namespace if the (workload) namespace is not already the root namespace
		// to avoid double inclusion.
		lookupInNamespaces = []string{namespace, rootNamespace}
	} else {
		lookupInNamespaces = []string{namespace}

	Name         string          `json:"name"`
	Namespace    string          `json:"namespace"`
	Hostname     string          `json:"hostname"`
	Addresses    []string        `json:"vips"`
	Ports        map[string]int  `json:"ports"`
	LoadBalancer *LoadBalancer   `json:"loadBalancer"`
	Waypoint     *GatewayAddress `json:"waypoint"`
}

type PolicyMatch struct {
	Namespaces          []StringMatch `json:"namespaces,omitempty"`

      namespaces:
        from: All
  - name: tls-cross
    hostname: cross-namespace.domain.example
    port: 443
    protocol: HTTPS
    allowedRoutes:
      namespaces:
        from: All
    tls:
      mode: Terminate
      certificateRefs:
      - kind: Secret
        name: test-gateway-cert-cross
        namespace: "%s"
  - name: tls-same
    hostname: same-namespace.domain.example

	return matched
}

// MatchesSingleNamespace will return (namespace, true) if and only if s.Field matches on the object's
// namespace.
func (s *SelectionPredicate) MatchesSingleNamespace() (string, bool) {
	if len(s.Continue) > 0 || s.Field == nil {
		return "", false
	}
	if namespace, ok := s.Field.RequiresExactMatch("metadata.namespace"); ok {
		return namespace, true
	}
	return "", false
}

}

func createTestRequestAuthenticationResource(
	name string, namespace string, selector *selectorpb.WorkloadSelector, targetRef *selectorpb.PolicyTargetReference,
) *config.Config {
	ra := &config.Config{
		Meta: config.Meta{
			GroupVersionKind: gvk.RequestAuthentication,
			Name:             name,
			Namespace:        namespace,
		},
		Spec: &securityBeta.RequestAuthentication{},
	}

		&compbasemetrics.CounterOpts{
			Namespace:      namespace,
			Name:           "cache_list_total",
			Help:           "Number of LIST requests served from watch cache",
			StabilityLevel: compbasemetrics.ALPHA,
		},
		[]string{"resource_prefix", "index"},
	)
	listCacheNumFetched = compbasemetrics.NewCounterVec(
		&compbasemetrics.CounterOpts{
			Namespace:      namespace,
			Name:           "cache_list_fetched_objects_total",

	return &ist
}

// GetAppNamespace gets echo app namespace instance.
func GetAppNamespace() namespace.Instance {
	return appNsInst
}

func GetIngressInstance() ingress.Instance {
	return ingInst
}

func GetZipkinInstance() zipkin.Instance {
	return zipkinInst
}

func TestSetup(ctx resource.Context) (err error) {
	appNsInst, err = namespace.New(ctx, namespace.Config{
		Prefix: "echo",
		Inject: true,
	})

    controllerExpandSecretRef:
      name: nameValue
      namespace: namespaceValue
    controllerPublishSecretRef:
      name: nameValue
      namespace: namespaceValue
    driver: driverValue
    fsType: fsTypeValue
    nodeExpandSecretRef:
      name: nameValue
      namespace: namespaceValue
    nodePublishSecretRef:
      name: nameValue
      namespace: namespaceValue
    nodeStageSecretRef:
      name: nameValue

          "controllerPublishSecretRef": {
            "name": "nameValue",
            "namespace": "namespaceValue"
          },
          "nodeStageSecretRef": {
            "name": "nameValue",
            "namespace": "namespaceValue"
          },
          "nodePublishSecretRef": {
            "name": "nameValue",
            "namespace": "namespaceValue"
          },
          "controllerExpandSecretRef": {