lock sync.Mutex
}

// UserNamespace holds the configuration for the user namespace.
type userNamespace struct {
	// UIDs mappings for the user namespace.
	UIDMappings []idMapping `json:"uidMappings"`
	// GIDs mappings for the user namespace.
	GIDMappings []idMapping `json:"gidMappings"`
}

// Pod user namespace mapping
type idMapping struct {
	// Required.
	HostId uint32 `json:"hostId"`
	// Required.

					result[NewScopedFqdn(ExportToAllNamespaces, r.Metadata.FullName.Namespace, h)] = s
					exportsToAll = true
				case ExportToNamespaceLocal:
					result[NewScopedFqdn(hostsNamespaceScope, r.Metadata.FullName.Namespace, h)] = s
				default:
					result[NewScopedFqdn(ns, r.Metadata.FullName.Namespace, h)] = s
				}

				// If exports to all, we don't need to check other namespaces
				if exportsToAll {
					break
				}
			}
		}

  name: cross-namespace
  namespace: istio-system
spec:
  hosts: [reviews]
  http:
    - route:
        - destination:
            # Should not generate error because the this host exists, just not in our namespace
            host: reviews.default.svc.cluster.local
---
apiVersion: v1
kind: Service
metadata:
  name: details
  namespace: default
  annotations:

kind: VirtualService
metadata:
  name: productpage
  namespace: foo
spec:
  hosts:
  - '*.productpage' # should generate an error as this conflicts with VirtualService bar/productpage
  http:
  - route:
    - destination:
        host: productpage
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: productpage
  namespace: bar
spec:
  hosts:

      namespace: default
      resourceVersion: '1234567890'
      uid: 11111111-2222-3333-4444-555555555555
  - ip: 10.0.0.1
    targetRef:
      kind: Pod
      name: pod-name-1234-0004
      namespace: default
      resourceVersion: '1234567890'
      uid: 11111111-2222-3333-4444-555555555555
  - ip: 10.0.0.1
    targetRef:
      kind: Pod
      name: pod-name-1234-0005
      namespace: default

			attrs:  authorizer.AttributesRecord{User: node0, ResourceRequest: true, Verb: "get", Resource: "leases", APIGroup: "coordination.k8s.io", Name: "node0", Namespace: "foo"},
			expect: authorizer.DecisionNoOpinion,
		},
		{
			name:   "disallowed create lease in namespace other than kube-node-lease - feature enabled",

				Name:            "reviews",
				Namespace:       "namespace1",
			},
			"reviews.namespace1",
		},
		{
			"Service with port pattern from different namespace",
			"%SERVICE%.%SERVICE_PORT%",
			"reviews.namespace1.svc.cluster.local",
			"",
			0,
			&model.Port{Name: "grpc-svc", Port: 7443, Protocol: "GRPC"},
			&model.ServiceAttributes{
				ServiceRegistry: provider.Kubernetes,

metadata:
  name: http
  namespace: default
spec:
  parentRefs:
  - name: gateway
    namespace: istio-system
  hostnames: ["first.domain.example", "another.domain.example"]
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /get
      headers:
      - name: my-header
        value: some-value
        type: Exact
    filters:
    - type: RequestHeaderModifier
      requestHeaderModifier:

			resource:      "pods",
			namespace:     metav1.NamespaceAll,
			fieldSelector: fields.Set{"spec.host": ""}.AsSelector(),
		},
		{
			desc: "pod in namespace 'foo'",
			location: buildLocation(
				"/api/v1/namespaces/foo/pods",
				buildQueryValues(url.Values{fieldSelectorQueryParamName: []string{"spec.host="}})),
			resource:      "pods",
			namespace:     "foo",

	}

	mux := http.NewServeMux()
	mux.HandleFunc("/api/v1/namespaces/"+namespace+"/endpoints", handlerFunc)
	mux.HandleFunc("/api/v1/namespaces/"+namespace+"/endpoints/", handlerFunc)
	mux.HandleFunc("/api/v1/namespaces/"+namespace+"/events", func(res http.ResponseWriter, req *http.Request) {})
	mux.HandleFunc("/", func(res http.ResponseWriter, req *http.Request) {