workloadLabels := selectionOpts.WorkloadLabels
	namespace := selectionOpts.Namespace
	configs := make([]*config.Config, 0)
	var lookupInNamespaces []string
	if namespace != rootNamespace {
		// Only check the root namespace if the (workload) namespace is not already the root namespace
		// to avoid double inclusion.
		lookupInNamespaces = []string{namespace, rootNamespace}
	} else {
		lookupInNamespaces = []string{namespace}

      type: ResolvedRefs
    controllerName: istio.io/gateway-controller
    parentRef:
      name: gateway
      namespace: istio-system
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  creationTimestamp: null
  name: http-not-selected
  namespace: default
spec: null
status:
  parents:
  - conditions:
    - lastTransitionTime: fake

}

func createTestRequestAuthenticationResource(
	name string, namespace string, selector *selectorpb.WorkloadSelector, targetRef *selectorpb.PolicyTargetReference,
) *config.Config {
	ra := &config.Config{
		Meta: config.Meta{
			GroupVersionKind: gvk.RequestAuthentication,
			Name:             name,
			Namespace:        namespace,
		},
		Spec: &securityBeta.RequestAuthentication{},
	}

		&compbasemetrics.CounterOpts{
			Namespace:      namespace,
			Name:           "cache_list_total",
			Help:           "Number of LIST requests served from watch cache",
			StabilityLevel: compbasemetrics.ALPHA,
		},
		[]string{"resource_prefix", "index"},
	)
	listCacheNumFetched = compbasemetrics.NewCounterVec(
		&compbasemetrics.CounterOpts{
			Namespace:      namespace,
			Name:           "cache_list_fetched_objects_total",

	return &ist
}

// GetAppNamespace gets echo app namespace instance.
func GetAppNamespace() namespace.Instance {
	return appNsInst
}

func GetIngressInstance() ingress.Instance {
	return ingInst
}

func GetZipkinInstance() zipkin.Instance {
	return zipkinInst
}

func TestSetup(ctx resource.Context) (err error) {
	appNsInst, err = namespace.New(ctx, namespace.Config{
		Prefix: "echo",
		Inject: true,
	})

// If the configmap is not found, it will be created.
// If the namespace is filtered out by discovery selector, the configmap will be deleted.
func (nc *NamespaceController) reconcileCACert(o types.NamespacedName) error {
	ns := o.Namespace
	if ns == "" {
		// For Namespace object, it will not have o.Namespace field set
		ns = o.Name
	}

		SetupParallel(
			namespace.Setup(&echo1NS, namespace.Config{Prefix: "echo1", Inject: true}),
			namespace.Setup(&serverNS, namespace.Config{Prefix: "servers", Inject: true}),
		).
		SetupParallel(
			jwt.Setup(&jwtServer, namespace.Future(&serverNS)),
			authz.Setup(&authzServer, namespace.Future(&serverNS)),
			authz.SetupLocal(&localAuthzServer, namespace.Future(&echo1NS)),

    controllerExpandSecretRef:
      name: nameValue
      namespace: namespaceValue
    controllerPublishSecretRef:
      name: nameValue
      namespace: namespaceValue
    driver: driverValue
    fsType: fsTypeValue
    nodeExpandSecretRef:
      name: nameValue
      namespace: namespaceValue
    nodePublishSecretRef:
      name: nameValue
      namespace: namespaceValue
    nodeStageSecretRef:
      name: nameValue

          "controllerPublishSecretRef": {
            "name": "nameValue",
            "namespace": "namespaceValue"
          },
          "nodeStageSecretRef": {
            "name": "nameValue",
            "namespace": "namespaceValue"
          },
          "nodePublishSecretRef": {
            "name": "nameValue",
            "namespace": "namespaceValue"
          },
          "controllerExpandSecretRef": {

          "controllerPublishSecretRef": {
            "name": "nameValue",
            "namespace": "namespaceValue"
          },
          "nodeStageSecretRef": {
            "name": "nameValue",
            "namespace": "namespaceValue"
          },
          "nodePublishSecretRef": {
            "name": "nameValue",
            "namespace": "namespaceValue"
          },
          "controllerExpandSecretRef": {