}

// RoleBinding references a role, but does not contain it.  It can reference a Role in the same namespace or a ClusterRole in the global namespace.
// It adds who information via Subjects and namespace information by which namespace it exists in.  RoleBindings in a given
// namespace only have effect in that namespace.
message RoleBinding {
  // Standard object's metadata.
  // +optional

	namespace, pod, container string,
) (string, *processlog.Stats, int, error) {
	defer logRuntime(time.Now(), "Done getting logs only for %v/%v/%v", namespace, pod, container)

	log.Infof("Getting logs for %s/%s/%s...", namespace, pod, container)
	clog, err := runner.Logs(namespace, pod, container, false, config.DryRun)
	if err != nil {
		return "", nil, 0, err
	}

			ownerIsNamespaced := len(ownerNode.identity.Namespace) > 0
			if ownerIsNamespaced && ownerNode.identity.Namespace != n.identity.Namespace {
				if ownerNode.isObserved() {
					// The owner node has been observed via an informer
					// the dependent's namespace doesn't match the observed owner's namespace, this is definitely wrong.
					// cluster-scoped owners can be referenced as an owner from any namespace or cluster-scoped object.

      - presence: {}
      principals:
      - exact: principal
      - prefix: principal-prefix-
      - suffix: -suffix-principal
      - presence: {}
- rules:
  - matches:
    - namespaces:
      - exact: ns
      - prefix: ns-prefix-
      - suffix: -ns-suffix
      - presence: {}
      notNamespaces:
      - exact: not-ns
      - prefix: not-ns-prefix-
      - suffix: -not-ns-suffix

              "apiGroupsValue"
            ],
            "resources": [
              "resourcesValue"
            ],
            "clusterScope": true,
            "namespaces": [
              "namespacesValue"
            ]
          }
        ],
        "nonResourceRules": [
          {
            "verbs": [
              "verbsValue"
            ],
            "nonResourceURLs": [

    - apiGroups:
      - apiGroupsValue
      clusterScope: true
      namespaces:
      - namespacesValue
      resources:
      - resourcesValue
      verbs:
      - verbsValue
    subjects:
    - group:
        name: nameValue
      kind: kindValue
      serviceAccount:
        name: nameValue
        namespace: namespaceValue
      user:
        name: nameValue
status:
  conditions:

			}
			c.initialSyncTimeout.Store(true)
		})
	}

	// Build a namespace watcher. This must have no filter, since this is our input to the filter itself.
	// This must be done before we build components, so they can access the filter.
	namespaces := kclient.New[*corev1.Namespace](c.Client)
	// This will start a namespace informer and wait for it to be ready. So we must start it in a go routine to avoid blocking.

	case *apiistioioapinetworkingv1alpha3.DestinationRule:
		return c.Istio().NetworkingV1alpha3().DestinationRules(namespace).(ktypes.WriteAPI[T])
	case *k8sioapidiscoveryv1.EndpointSlice:
		return c.Kube().DiscoveryV1().EndpointSlices(namespace).(ktypes.WriteAPI[T])
	case *k8sioapicorev1.Endpoints:
		return c.Kube().CoreV1().Endpoints(namespace).(ktypes.WriteAPI[T])
	case *apiistioioapinetworkingv1alpha3.EnvoyFilter:

// the namespace.
func GetNamespaceLabelsSnapshot(logger klog.Logger, ns string, nsLister listersv1.NamespaceLister) (nsLabels labels.Set) {
	podNS, err := nsLister.Get(ns)
	if err == nil {
		// Create and return snapshot of the labels.
		return labels.Merge(podNS.Labels, nil)
	}
	logger.V(3).Info("getting namespace, assuming empty set of namespace labels", "namespace", ns, "err", err)
	return
}

		ps.gatewayIndex.namespace = make(map[string][]config.Config)
		for _, gatewayConfig := range gatewayConfigs {
			if _, exists := ps.gatewayIndex.namespace[gatewayConfig.Namespace]; !exists {
				ps.gatewayIndex.namespace[gatewayConfig.Namespace] = make([]config.Config, 0)
			}
			ps.gatewayIndex.namespace[gatewayConfig.Namespace] = append(ps.gatewayIndex.namespace[gatewayConfig.Namespace], gatewayConfig)
		}