}
	kind := obj.GetObjectKind()
	oldGVK := kind.GroupVersionKind()
	gvk := gvks[0]
	if e.Version != nil {
		preferredGVK, ok := e.Version.KindForGroupVersionKinds(gvks)
		if ok {
			gvk = preferredGVK
		}
	}

	// The gvk only needs to be set if not already as desired.
	if gvk != oldGVK {
		kind.SetGroupVersionKind(gvk)
		defer kind.SetGroupVersionKind(oldGVK)
	}

			return err
		}
	}
	if _, err := fmt.Fprintf(w, "  ];\n"); err != nil {
		return err
	}
	return nil
}

func (v *dotVertex) String() string {
	kind := v.gvk.Kind + "." + v.gvk.Version
	if len(v.gvk.Group) > 0 {
		kind = kind + "." + v.gvk.Group
	}
	missing := ""
	if v.missingFromGraph {
		missing = "(missing)"
	}
	deleting := ""
	if v.beingDeleted {
		deleting = "(deleting)"
	}

				Meta: config.Meta{
					GroupVersionKind: gvk.HTTPRoute,
					Name:             "test",
					Namespace:        "default",
					Domain:           "cluster",
				},
				Spec: &gateway.HTTPRouteSpec{
					Hostnames: []gateway.Hostname{"example.com"},
				},
			},
		},
		{
			name: "gateway status",
			cfg: config.Config{
				Meta: config.Meta{
					GroupVersionKind: gvk.HTTPRoute,
					Name:             "test",

	meta := analysis.Metadata{
		Name:        "webhook.Analyzer",
		Description: "Checks the validity of Istio webhooks",
		Inputs: []config.GroupVersionKind{
			gvk.MutatingWebhookConfiguration,
		},
	}
	if !a.SkipServiceCheck {
		meta.Inputs = append(meta.Inputs, gvk.Service)
	}
	return meta
}

func getNamespaceLabels() []klabels.Set {
	return []klabels.Set{
		{},
		{"istio-injection": "enabled"},

	"istio.io/istio/pkg/config/schema/gvk"
	"istio.io/istio/pkg/test"
)

func TestPolicyMatcher(t *testing.T) {
	sampleTargetRef := &v1beta1.PolicyTargetReference{
		Group: gvk.KubernetesGateway.Group,
		Kind:  gvk.KubernetesGateway.Kind,
		Name:  "sample-gateway",
	}
	waypointTargetRef := &v1beta1.PolicyTargetReference{
		Group: gvk.KubernetesGateway.Group,
		Kind:  gvk.KubernetesGateway.Kind,
		Name:  "sample-waypoint",

	"istio.io/istio/pkg/config/schema/gvk"
)

type CertificateAnalyzer struct{}

var _ analysis.Analyzer = &CertificateAnalyzer{}

func (*CertificateAnalyzer) Metadata() analysis.Metadata {
	return analysis.Metadata{
		Name:        "gateway.CertificateAnalyzer",
		Description: "Checks a gateway certificate",
		Inputs: []config.GroupVersionKind{
			gvk.Gateway,
		},
	}
}

	object *apiservercel.DeclType
	params *apiservercel.DeclType
}

// TypeCheckingResult holds the issues found during type checking, any returned
// error, and the gvk that the type checking is performed against.
type TypeCheckingResult struct {
	// GVK is the associated GVK
	GVK schema.GroupVersionKind
	// Issues contain machine-readable information about the typechecking result.
	Issues error

	err := f.primary.HasSupport(gvk)
	// If an error was returned from the primary OpenAPI endpoint,
	// we fallback to check the secondary OpenAPI endpoint for
	// any error *except* "paramUnsupportedError".
	if err != nil && !IsParamUnsupportedError(err) {
		klog.V(7).Infof("openapi v3 error...falling back to legacy: %s", err)
		err = f.secondary.HasSupport(gvk)
	}
	return err

		},
	}
	virtualService := config.Config{
		Meta: config.Meta{
			GroupVersionKind: gvk.VirtualService,
			Name:             "virtual-service",
			Namespace:        "default",
		},
		Spec: virtualServiceSpec,
	}
	virtualServiceCaseInsensitive := config.Config{
		Meta: config.Meta{
			GroupVersionKind: gvk.VirtualService,
			Name:             "virtual-service-case-insensitive",

}

type noCorrespondingTypeErr struct {
	gvk schema.GroupVersionKind
}

func NewNoCorrespondingTypeError(gvk schema.GroupVersionKind) error {
	return &noCorrespondingTypeErr{gvk: gvk}
}

func (k *noCorrespondingTypeErr) Error() string {
	return fmt.Sprintf("no corresponding type for %v", k.gvk)
}

func isNoCorrespondingTypeError(err error) bool {
	if err == nil {