"This mirrors the C++ syntax for referring to a class, where multiple "
       "namespaces may precede the class name, separated by double-colons.  "
       "The class will be generated in the given namespace(s), or if no "
       "namespaces are given, within the global namespace."},
      {"out_function_object", &flags->out_function_object,
       "Output object file containing the generated function for the "

  name: cross-namespace
  namespace: istio-system
spec:
  hosts: [reviews]
  http:
    - route:
        - destination:
            # Should not generate error because the this host exists, just not in our namespace
            host: reviews.default.svc.cluster.local
---
apiVersion: v1
kind: Service
metadata:
  name: details
  namespace: default
  annotations:

#define TENSORFLOW_COMPILER_MLIR_QUANTIZATION_TENSORFLOW_PASSES_QUANTIZED_FUNCTION_LIBRARY_H_
""")

    for namespace in namespaces:
      f.write('namespace {0} {{\n'.format(namespace))

    for tag, module in modules:
      f.write('constexpr char {0}[] ='.format(module_prefix + tag.upper()))

      for line in module.splitlines():
        f.write('\n  "')

apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: consumer-override
  namespace: default
spec:
  parentRefs:
  - group: ""
    kind: Service
    name: httpbin-apple
    namespace: apple
    port: 80
  rules:
  - backendRefs:
    - name: httpbin-apple
      namespace: apple
      port: 80
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
metadata:

			"foo": "bar",
		},
	}}
	ns2 := &v1.Namespace{ObjectMeta: metav1.ObjectMeta{
		Name: "ns2",
		Labels: map[string]string{
			"allowed": "true",
		},
	}}
	ns := clienttest.Wrap(t, c.namespaces)

	ns.Create(ns1)
	s.AssertEmpty(t, time.Millisecond*10)

	ns.Create(ns2)
	s.AssertEmpty(t, time.Millisecond*10)

	ns1.Annotations = map[string]string{"foo": "bar"}
	ns.Update(ns1)

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: gateway
  namespace: istio-system
spec:
  addresses:
  - value: istio-ingressgateway
    type: Hostname
  gatewayClassName: istio
  listeners:
  - name: default
    hostname: "*.domain.example"
    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:
        from: Selector
        selector:
          matchLabels:

	// ignore all operations that correspond to sub-resource actions
	if attr.GetSubresource() != "" {
		return nil
	}
	// ignore all operations that are not namespaced or creation of namespaces
	if attr.GetNamespace() == "" || isNamespaceCreation(attr) {
		return nil
	}
	return a.evaluator.Evaluate(attr)
}

func isNamespaceCreation(attr admission.Attributes) bool {

    - apiGroups:
      - apiGroupsValue
      clusterScope: true
      namespaces:
      - namespacesValue
      resources:
      - resourcesValue
      verbs:
      - verbsValue
    subjects:
    - group:
        name: nameValue
      kind: kindValue
      serviceAccount:
        name: nameValue
        namespace: namespaceValue
      user:
        name: nameValue
status:
  conditions:

              "apiGroupsValue"
            ],
            "resources": [
              "resourcesValue"
            ],
            "clusterScope": true,
            "namespaces": [
              "namespacesValue"
            ]
          }
        ],
        "nonResourceRules": [
          {
            "verbs": [
              "verbsValue"
            ],
            "nonResourceURLs": [

    - apiGroups:
      - apiGroupsValue
      clusterScope: true
      namespaces:
      - namespacesValue
      resources:
      - resourcesValue
      verbs:
      - verbsValue
    subjects:
    - group:
        name: nameValue
      kind: kindValue
      serviceAccount:
        name: nameValue
        namespace: namespaceValue
      user:
        name: nameValue
status:
  conditions: