}
}

func checkIopExist(cs istiokube.CLIClient, iopName string) (bool, error) {
	scopes.Framework.Infof("checking IstioOperator CR status")
	gvr := iopv1alpha1.IstioOperatorGVR

	_, err := cs.Dynamic().Resource(gvr).Namespace(IstioNamespace).Get(context.TODO(), iopName, metav1.GetOptions{})
	if errors.IsNotFound(err) {
		return false, nil
	} else if err == nil {
		return true, nil
	}

	scopes.Framework.Info("cleaning up in-cluster CRs")
	gvr := iopv1alpha1.IstioOperatorGVR
	crList, err := cs.Dynamic().Resource(gvr).Namespace(IstioNamespace).List(context.TODO(),
		metav1.ListOptions{})
	if err == nil {
		for _, obj := range crList.Items {
			t.Logf("deleting CR %v", obj.GetName())
			if err := cs.Dynamic().Resource(gvr).Namespace(IstioNamespace).Delete(context.TODO(), obj.GetName(),

			// we only need to authorize the parsed group/version
			apiGroup = gv.Group
			apiVersion = gv.Version
			if gvr, err := v.resourceResolver.Resolve(gv.WithKind(paramKind.Kind)); err == nil {
				// we only need to authorize the resolved resource
				resource = gvr.Resource
			}
		}
	}

	var attrs authorizer.AttributesRecord

	paramRef := binding.Spec.ParamRef
	verb := "get"

			MeshWatcher:     mesh.NewFixedWatcher(m),
			CRDs: []schema.GroupVersionResource{
				// Install all CRDs used (mostly in Ambient)
				gvr.AuthorizationPolicy,
				gvr.PeerAuthentication,
				gvr.KubernetesGateway,
				gvr.KubernetesGateway,
				gvr.WorkloadEntry,
				gvr.ServiceEntry,
			},
		})
		stop := test.NewStop(t)
		// start default client informers after creating ingress/secret controllers

			"Entries":     inp.Entries,
			"PackageName": "gvk",
		}),
		writeTemplate("pkg/config/schema/gvr/resources.gen.go", gvrTemplate, map[string]any{
			"Entries":     gvrEntries,
			"PackageName": "gvr",
		}),
		writeTemplate("pilot/pkg/config/kube/crdclient/types.gen.go", crdclientTemplate, map[string]any{
			"Entries":     inp.Entries,
			"Packages":    inp.Packages,

	}

	d.patcher = func(g schema.GroupVersionResource, name string, namespace string, data []byte, subresources ...string) error {
		if g == gvr.Service {
			reconciles.Inc()
		}
		if g == gvr.KubernetesGateway {
			b, err := yaml.JSONToYAML(data)
			if err != nil {
				return err
			}
			writes <- string(b)
		}
		return nil
	}
	stop := test.NewStop(t)

	}

	return c.dispatcher.Dispatch(ctx, a, o, c.source.Hooks())
}

func (c *Plugin[H]) shouldIgnoreResource(attr admission.Attributes) bool {
	gvr := attr.GetResource()
	// exclusion decision ignores the version.
	gr := gvr.GroupResource()
	return c.excludedResources.Has(gr)

	"k8s.io/apimachinery/pkg/runtime/schema"
	"k8s.io/apimachinery/pkg/types"
	"sigs.k8s.io/gateway-api/pkg/consts"

	"istio.io/istio/pilot/pkg/features"
	"istio.io/istio/pkg/config/schema/gvr"
	"istio.io/istio/pkg/kube"
	"istio.io/istio/pkg/kube/controllers"
	"istio.io/istio/pkg/kube/kubetypes"
	"istio.io/istio/pkg/log"
)

type crdWatcher struct {
	crds      Informer[*metav1.PartialObjectMetadata]

	"istio.io/istio/pkg/typemap"
)

func MustGVRFromType[T runtime.Object]() schema.GroupVersionResource {
	if gk, ok := getGvk(ptr.Empty[T]()); ok {
		gr, ok := gvk.ToGVR(gk)
		if !ok {
			panic(fmt.Sprintf("unknown GVR for GVK %v", gk))
		}
		return gr
	}
	if rp := typemap.Get[RegisterType[T]](registeredTypes); rp != nil {
		return (*rp).GetGVR()
	}
	panic("unknown kind: " + ptr.TypeName[T]())
}

			},
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			gvr := corev1.SchemeGroupVersion.WithResource("pods")
			listerForPod := map[schema.GroupVersionResource]cache.GenericLister{
				gvr: newGenericLister(gvr.GroupResource(), tt.objs),
			}
			evaluator := NewPodEvaluator(mockListerForResourceFunc(listerForPod), testingclock.NewFakeClock(time.Now()))