// only if either (a) this list contains that target namespace or
	// (b) this list contains "*".  Note that "*" matches any
	// specified namespace but does not match a request that _does
	// not specify_ a namespace (see the `clusterScope` field for
	// that).
	// This list may be empty, but only if `clusterScope` is true.
	// +optional
	// +listType=set

		s := rs.Message.(*v1alpha3.Sidecar)

		// record namespace-scoped sidecars
		if s.WorkloadSelector == nil || len(s.WorkloadSelector.Labels) == 0 {
			namespacesToSidecars[rs.Metadata.FullName.Namespace] = append(namespacesToSidecars[rs.Metadata.FullName.Namespace], rs)
			return true
		}

		sNs := rs.Metadata.FullName.Namespace
		sel := labels.SelectorFromSet(s.WorkloadSelector.Labels)

		foundPod := false

  string class_name;

  // Target triple for the architecture we're targeting.
  string target_triple;

  // Namespaces specifies a list of C++ namespaces to add to the generated
  // header.  If empty, all symbols will be in the global namespace.
  std::vector<string> namespaces;

  // If true, generate name-to-index data for Lookup{Arg,Result}Index methods.
  bool gen_name_to_index = false;

		}
	}

	// ensure bootstrap namespaced roles are created or reconciled
	for namespace, roles := range p.Roles {
		for _, role := range roles {
			opts := reconciliation.ReconcileRoleOptions{
				Role:    reconciliation.RoleRuleOwner{Role: &role},
				Client:  reconciliation.RoleModifier{Client: client.RbacV1(), NamespaceClient: client.CoreV1().Namespaces()},
				Confirm: true,
			}

kind: Gateway
metadata:
  name: third-party-gateway
  namespace: istio-system
spec:
  addresses:
  - value: istio-ingressgateway
    type: Hostname
  gatewayClassName: third-party-gatewayclass
  listeners:
  - name: default
    hostname: "*.domain.example"
    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:
        from: All
---
apiVersion: gateway.networking.k8s.io/v1beta1

     *
     * @param namespace The namespace of the element whose value should be returned
     * @param name The name of the element whose value should be returned
     * @return The value of the element, or null if there is no such element.
     */
    @Nullable
    String get(String namespace, String name);

    /**

	}

	// try fetching the namespace-defined waypoint
	namespace := ptr.OrEmpty[*v1.Namespace](krt.FetchOne[*v1.Namespace](ctx, Namespaces, krt.FilterKey(o.Namespace)))
	// this probably should never be nil. How would o exist in a namespace we know nothing about? maybe edge case of starting the controller or ns delete?
	if namespace != nil {
		// toss isNone, we don't need to know /why/ we got nil

			expectErr:   false,
			expectObjNS: "",
		},
		{
			name:        "cluster-scoped req, namespaced obj",
			reqNS:       "",
			objNS:       "foo",
			expectErr:   false,
			expectObjNS: "", // no error, object is forced to cluster-scoped for backwards compatibility
		},
		{
			name:        "namespaced req, no-namespace obj",
			reqNS:       "foo",
			objNS:       "",
			expectErr:   false,

)

func TestPatch(t *testing.T) {
	storage := map[string]rest.Storage{}
	ID := "id"
	item := &genericapitesting.Simple{
		ObjectMeta: metav1.ObjectMeta{
			Name:      ID,
			Namespace: "", // update should allow the client to send an empty namespace
			UID:       "uid",
		},
		Other: "bar",
	}
	simpleStorage := SimpleRESTStorage{item: *item}
	storage["simple"] = &simpleStorage
	handler := handle(storage)

apiVersion: test.com/v1
kind: Example
metadata:
  name: test
  namespace: default
spec: