}

	if platform.IsOpenShift() && wh.namespaces != nil {
		clusterID, _ := extractClusterAndNetwork(params)
		if clusterID == "" {
			clusterID = constants.DefaultClusterName
		}
		client := wh.namespaces.ForCluster(cluster.ID(clusterID))
		if client != nil {
			params.namespace = client.Get(pod.Namespace, "")
		} else {
			log.Warnf("unable to fetch namespace, failed to get client for %q", clusterID)
		}

            - key: keyValue
              operator: operatorValue
              values:
              - valuesValue
            matchLabels:
              matchLabelsKey: matchLabelsValue
          namespaces:
          - namespacesValue
          topologyKey: topologyKeyValue
        weight: 1
      requiredDuringSchedulingIgnoredDuringExecution:
      - labelSelector:
          matchExpressions:

                  "operator": "operatorValue",
                  "values": [
                    "valuesValue"
                  ]
                }
              ]
            },
            "namespaces": [
              "namespacesValue"
            ],
            "topologyKey": "topologyKeyValue",
            "namespaceSelector": {
              "matchLabels": {

roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:coredns
subjects:
- kind: ServiceAccount
  name: coredns
  namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: coredns
  namespace: kube-system
`),
			wantErr: false,
		},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			out := &bytes.Buffer{}

	}
	log.Errorf("< END DUMP (index %v[%T]", i.c.(internalCollection[I]).name(), ptr.TypeName[K]())
}

// NewNamespaceIndex is a small helper to index a collection by namespace
func NewNamespaceIndex[I Namespacer](c Collection[I]) *Index[I, string] {
	return NewIndex(c, func(o I) []string {
		return []string{o.GetNamespace()}
	})
}

	// if `paramKind` is namespace-scoped.
	//
	Name string `json:"name,omitempty" protobuf:"bytes,1,rep,name=name"`

	// namespace is the namespace of the referenced resource. Allows limiting
	// the search for params to a specific namespace. Applies to both `name` and
	// `selector` fields.
	//
	// A per-namespace parameter may be used by specifying a namespace-scoped

    taint:
      # Controls whether or not the untaint controller is active
      enabled: false
      # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
      namespace: ""
    affinity: {}
    tolerations: []
    cpu:
      targetAverageUtilization: 80
    memory: {}
    # targetAverageUtilization: 80

                    minLength: 1
                    type: string
                  namespace:
                    description: namespace is the namespace of the referent.
                    type: string
                    x-kubernetes-validations:
                    - message: cross namespace referencing is not currently supported
                      rule: self.size() == 0
                required:

      value: "{{ .DeploymentMeta.Name }}"
    {{ end }}
    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
    - name: ISTIO_META_OWNER
      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
    {{- end}}
    {{- if .Values.global.meshID }}
    - name: ISTIO_META_MESH_ID
      value: "{{ .Values.global.meshID }}"

                    minLength: 1
                    type: string
                  namespace:
                    description: namespace is the namespace of the referent.
                    type: string
                    x-kubernetes-validations:
                    - message: cross namespace referencing is not currently supported
                      rule: self.size() == 0
                required: