if service == nil {
		return p
	}
	if service.Attributes.Namespace != p.Namespace {
		log.Debugf("matching policy for service in namespace %s for workload in %s", service.Attributes.Namespace, p.Namespace)
	}

	p.Service = service.Attributes.Name
	return p
}

// workloadGatewayName returns the name of the gateway for which a workload is an instance.

		&compbasemetrics.GaugeOpts{
			Namespace:      namespace,
			Subsystem:      subsystem,
			Name:           "current_r",
			Help:           "R(time of last change)",
			StabilityLevel: compbasemetrics.ALPHA,
		},
		[]string{priorityLevel},
	)
	apiserverDispatchR = compbasemetrics.NewGaugeVec(
		&compbasemetrics.GaugeOpts{
			Namespace:      namespace,
			Subsystem:      subsystem,

kind: AuthorizationPolicy
metadata:
  name: httpbin-1
  namespace: foo
spec:
  selector:
    matchLabels:
      app: httpbin
      version: v1
  rules:
  - to:
    - operation:
        methods: ["GET", "POST"]
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: httpbin-2
  namespace: foo
spec:
  selector:
    matchLabels:
      app: httpbin
  rules:

# This configures all services within the namespace to use mTLS with permissive mode (allowing plaintext).

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: ns-default
  namespace: {{ .To.NamespaceName }}
spec:
  mtls:
    mode: PERMISSIVE

---
# This configures requests to any service in the namespace to use mTLS.

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:

				New().
				Eval(
					apps.Namespace.Name(),
					map[string]any{
						"Service":   Captured,
						"Namespace": apps.Namespace.Name(),
						"Port":      apps.Captured.PortForName("http").ServicePort,
					},
					config).
				ApplyOrFail(t, apply.CleanupConditionally)

			retry.UntilSuccessOrFail(t, func() error {
				return checkWaypointIsReady(t, apps.Namespace.Name(), "simple-http-waypoint")

	"k8s.io/kubernetes/pkg/auth/nodeidentifier"
	"k8s.io/utils/pointer"
)

func makeTestPod(namespace, name, node string, mirror bool) (*api.Pod, *corev1.Pod) {
	corePod := &api.Pod{}
	corePod.Namespace = namespace
	corePod.UID = types.UID("pod-uid")
	corePod.Name = name
	corePod.Spec.NodeName = node
	v1Pod := &corev1.Pod{}
	v1Pod.Namespace = namespace
	v1Pod.UID = types.UID("pod-uid")
	v1Pod.Name = name
	v1Pod.Spec.NodeName = node

          "controllerPublishSecretRef": {
            "name": "nameValue",
            "namespace": "namespaceValue"
          },
          "nodeStageSecretRef": {
            "name": "nameValue",
            "namespace": "namespaceValue"
          },
          "nodePublishSecretRef": {
            "name": "nameValue",
            "namespace": "namespaceValue"
          },
          "controllerExpandSecretRef": {

        kind: kindValue
        name: nameValue
        namespace: namespaceValue
        resourceVersion: resourceVersionValue
        uid: uidValue
      csi:
        controllerExpandSecretRef:
          name: nameValue
          namespace: namespaceValue
        controllerPublishSecretRef:
          name: nameValue
          namespace: namespaceValue
        driver: driverValue
        fsType: fsTypeValue

        kind: kindValue
        name: nameValue
        namespace: namespaceValue
        resourceVersion: resourceVersionValue
        uid: uidValue
      csi:
        controllerExpandSecretRef:
          name: nameValue
          namespace: namespaceValue
        controllerPublishSecretRef:
          name: nameValue
          namespace: namespaceValue
        driver: driverValue
        fsType: fsTypeValue

    gateway.networking.k8s.io/gateway-name: namespace
    istio.io/gateway-name: namespace
    topology.istio.io/network: network-1
  name: namespace
  namespace: default
  ownerReferences:
  - apiVersion: gateway.networking.k8s.io/v1beta1
    kind: Gateway
    name: namespace
    uid: ""
spec:
  selector:
    matchLabels:
      gateway.networking.k8s.io/gateway-name: namespace
  template:
    metadata: