}
	labels := map[string]string{
		"app": "foo",
	}
	namespace := "namespace"
	serviceEntry := config.Config{
		Meta: config.Meta{
			Name:             "service-entry",
			Namespace:        namespace,
			GroupVersionKind: gvk.ServiceEntry,
			Domain:           "cluster.local",
		},
		Spec: &networking.ServiceEntry{
			Hosts: []string{"service.namespace.svc.cluster.local"},
			Ports: []*networking.ServicePort{port},

# Namespace 'enabled-namespace' has istio injection enabled, so will be enforced.
apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio-injection: enabled
  name: enabled-namespace
---
# Namespace 'enabled-namespace-2' has istio injection enabled, so will be enforced.
apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio-injection: enabled
  name: enabled-namespace-2
---

	}{
		{"Just wildcard", []string{"*/*"}, allContains(nsName, true)},
		{"Namespace and wildcard", []string{"ns/*", "*/*"}, allContains(nsName, true)},
		{"Just Namespace", []string{"ns/*"}, allContains(nsName, true)},
		{"Wrong Namespace", []string{"ns/*"}, allContains("other-ns", false)},
		{"No Sidecar", nil, allContains("ns", true)},
		{"No Sidecar Other Namespace", nil, allContains("other-ns", false)},

	newNamespace := obj.(*api.Namespace)
	oldNamespace := old.(*api.Namespace)
	newNamespace.Spec.Finalizers = oldNamespace.Spec.Finalizers
	newNamespace.Status = oldNamespace.Status
}

// Validate validates a new namespace.
func (namespaceStrategy) Validate(ctx context.Context, obj runtime.Object) field.ErrorList {
	namespace := obj.(*api.Namespace)
	return validation.ValidateNamespace(namespace)
}

			selectionOpts: WorkloadPolicyMatcher{
				Namespace: "istio-config",
			},
			configs: []config.Config{
				newConfig("authz-1", "istio-config", policy),
			},
			wantAllow: []AuthorizationPolicy{
				{
					Name:      "authz-1",
					Namespace: "istio-config",
					Spec:      policy,
				},
			},
		},
		{
			name: "root namespace and config namespace",

	"sort"
	"strings"

	"istio.io/istio/pkg/test/framework/components/namespace"
	"istio.io/istio/pkg/util/sets"
)

// NamespacedName represents the full name of a service.
type NamespacedName struct {
	// Namespace of the echo Instance. If not provided, a default namespace "apps" is used.
	Namespace namespace.Instance

	// Name of the service within the Namespace.
	Name string
}

func printNS(writer io.Writer, namespaces []corev1.Namespace, hooks []admitv1.MutatingWebhookConfiguration,
	allPods map[resource.Namespace][]corev1.Pod,
) error {
	outputCount := 0

	w := new(tabwriter.Writer).Init(writer, 0, 8, 1, ' ', 0)
	for _, namespace := range namespaces {
		revision := getInjectedRevision(&namespace, hooks)
		podCount := podCountByRevision(allPods[resource.Namespace(namespace.Name)], revision)
		if len(podCount) == 0 {

	tt.WaitUnordered("add/namespace/name")

	pc.Delete(pod.Name, pod.Namespace)
	assert.EventuallyEqual(t, fetcherSorted(SimplePods), nil)
	tt.WaitUnordered("delete/namespace/name")
}

func TestCollectionInitialState(t *testing.T) {
	c := kube.NewFakeClient(
		&corev1.Pod{
			ObjectMeta: metav1.ObjectMeta{
				Name:      "pod",
				Namespace: "namespace",
				Labels:    map[string]string{"app": "foo"},

func (h *Helm) DeleteChart(name, namespace string) error {
	command := fmt.Sprintf("helm delete %s --namespace %s --kubeconfig %s", name, namespace, h.kubeConfig)
	_, err := execCommand(command)
	return err
}

// Template runs the template command and applies the generated file with kubectl

apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio-injection: enabled
  name: ns-override
---
apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio-injection: enabled
  name: workload-override
---
# ProxyConfig for root namespace
apiVersion: networking.istio.io/v1beta1
kind: ProxyConfig
metadata:
  name: valid-example-pc
  namespace: istio-system
---
# ProxyConfig for ns-override namespace