- apiGroups:
      - apiGroupsValue
      clusterScope: true
      namespaces:
      - namespacesValue
      resources:
      - resourcesValue
      verbs:
      - verbsValue
    subjects:
    - group:
        name: nameValue
      kind: kindValue
      serviceAccount:
        name: nameValue
        namespace: namespaceValue
      user:
        name: nameValue
status:
  conditions:

              "apiGroupsValue"
            ],
            "resources": [
              "resourcesValue"
            ],
            "clusterScope": true,
            "namespaces": [
              "namespacesValue"
            ]
          }
        ],
        "nonResourceRules": [
          {
            "verbs": [
              "verbsValue"
            ],
            "nonResourceURLs": [

              "apiGroupsValue"
            ],
            "resources": [
              "resourcesValue"
            ],
            "clusterScope": true,
            "namespaces": [
              "namespacesValue"
            ]
          }
        ],
        "nonResourceRules": [
          {
            "verbs": [
              "verbsValue"
            ],
            "nonResourceURLs": [

      namespaces:
        from: All
  - name: tls-cross
    hostname: cross-namespace.domain.example
    port: 443
    protocol: HTTPS
    allowedRoutes:
      namespaces:
        from: All
    tls:
      mode: Terminate
      certificateRefs:
      - kind: Secret
        name: test-gateway-cert-cross
        namespace: "%s"
  - name: tls-same
    hostname: same-namespace.domain.example

			serviceaccounts = append(serviceaccounts, kubeToIstioServiceAccount(ksa, svc.Namespace, mesh))
		}
	}
	if svc.Annotations[annotation.NetworkingExportTo.Name] != "" {
		namespaces := strings.Split(svc.Annotations[annotation.NetworkingExportTo.Name], ",")
		exportTo = sets.NewWithLength[visibility.Instance](len(namespaces))
		for _, ns := range namespaces {
			exportTo.Insert(visibility.Instance(ns))
		}
	}

    - apiGroups:
      - apiGroupsValue
      clusterScope: true
      namespaces:
      - namespacesValue
      resources:
      - resourcesValue
      verbs:
      - verbsValue
    subjects:
    - group:
        name: nameValue
      kind: kindValue
      serviceAccount:
        name: nameValue
        namespace: namespaceValue
      user:
        name: nameValue
status:
  conditions:

		Setup(deployment.SetupSingleNamespace(&apps, deployment.Config{
			Namespaces: []namespace.Getter{
				namespace.Future(&echo1NS),
			},
			Configs: echo.ConfigFuture(&customConfig),
		})).
		Setup(func(ctx resource.Context) error {
			return ingressutil.CreateCustomInstances(&apps)
		}).
		Run()
}

// TestTlsGatewaysWithQUIC deploys multiple TLS gateways with SDS enabled, and creates kubernetes that store

	dc.clients[gvr.ServiceAccount] = NewUntypedWrapper(dc.serviceAccounts)

	dc.namespaces = kclient.NewFiltered[*corev1.Namespace](client, filter)
	dc.namespaces.AddEventHandler(controllers.ObjectHandler(func(o controllers.Object) {
		// TODO: make this more intelligent, checking if something we care about has changed
		// requeue this namespace
		for _, gw := range dc.gateways.List(o.GetName(), klabels.Everything()) {

			continue
		} else if len(paramRef.Namespace) > 0 && p.GetNamespace() != paramRef.Namespace {
			continue
		}

		if !paramIsClusterScoped {
			// If the paramRef has empty namespace and the kind is
			// namespaced-scoped, then it only matches params of the same
			// namespace
			if len(paramRef.Namespace) == 0 && p.GetNamespace() != namespacedRequestObject.GetNamespace() {
				continue

type AffinityTerm struct {
	Namespaces        sets.Set[string]
	Selector          labels.Selector
	TopologyKey       string
	NamespaceSelector labels.Selector
}

// Matches returns true if the pod matches the label selector and namespaces or namespace selector.
func (at *AffinityTerm) Matches(pod *v1.Pod, nsLabels labels.Set) bool {
	if at.Namespaces.Has(pod.Namespace) || at.NamespaceSelector.Matches(nsLabels) {