parentRef:
      kind: Gateway
      name: gateway
      namespace: istio-system
      sectionName: same-namespace
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  creationTimestamp: null
  name: section-name-cross-namespace
  namespace: default
spec: null
status:
  parents:
  - conditions:
    - lastTransitionTime: fake

      allowedRoutes:
        namespaces:
          from: All
    - name: abc-foo-example-com
      port: 80
      protocol: HTTP
      hostname: "abc.foo.example.com"
      allowedRoutes:
        namespaces:
          from: All
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: attaches-to-empty-hostname-with-hostname-intersection
  namespace: gateway-conformance-infra
spec:

				APIGroup:          "",
				APIVersion:        "v1",
				Namespace:         "default",
				Resource:          "pods",
			}),
			expected: []MatchValue{{IndexName: FieldIndex("metadata.namespace"), Value: "default"}},
		},
		"Match field for listing namespace pods with metadata.namespace field selector": {
			labelSelector: "",
			fieldSelector: "metadata.namespace=kube-system",
			indexLabels:   []string{},

			return
		}
	}
	c.queue.Add(sa.Namespace)
}

// namespaceAdded reacts to a Namespace creation by creating a default ServiceAccount object
func (c *ServiceAccountsController) namespaceAdded(obj interface{}) {
	namespace := obj.(*v1.Namespace)
	c.queue.Add(namespace.Name)
}

// namespaceUpdated reacts to a Namespace update (or re-list) by creating a default ServiceAccount in the namespace if needed

# Namespace 'enabled-namespace' has istio injection enabled, so will be enforced.
apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio-injection: enabled
  name: enabled-namespace
---
# Details-v1-pod-old is out of date and should get a warning.
apiVersion: v1
kind: Pod
metadata:
  labels:
    app: details
  name: details-v1-pod-old
  namespace: enabled-namespace
spec:
  containers:

				},
				namespace: "bar",
			},
			false,
		},
		{
			"source namespace not match when empty",
			args{
				match: &v1alpha3.TLSMatchAttributes{
					SourceNamespace: "foo",
				},
				namespace: "",
			},
			false,
		},
		{
			"source namespace any",
			args{
				match:     &v1alpha3.TLSMatchAttributes{},
				namespace: "bar",
			},
			true,
		},
	}

kind: Gateway
metadata:
  name: gateway
  namespace: istio-system
spec:
  gatewayClassName: istio
  listeners:
  - name: default
    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:
        from: All
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: http
  namespace: default
spec:
  parentRefs:
  - name: gateway

				Name:        "test",
				Namespace:   "test",
				Labels:      ambientEnabledLabel,
				Annotations: sidecarStatusAnnotation,
			},
		}
	)

	type args struct {
		namespace *corev1.Namespace
		pod       *corev1.Pod
	}
	tests := []struct {
		name string
		args args
		want bool
	}{
		{
			name: "ambient mode enabled for namespace",
			args: args{

apiVersion: v1
kind: Namespace
metadata:
  name: bookinfo
  labels:
    istio-injection: "enabled"
spec: {}
---
# Deployment should generate a warning: two services using that deployment
# using the same port but different protocol.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: multiple-svc-multiple-prot
  namespace: bookinfo
  labels:
    app: details
    version: v1
spec:
  replicas: 1
  selector:

				spiffe.Identity{TrustDomain: "cluster.local", Namespace: "namespace", ServiceAccount: "serviceaccount"}.String(),
			},
			sa:        "serviceaccount",
			namespace: "namespace",
			success:   true,
		},
		{
			name: "no match namespace",
			identity: []string{