}
	return utilerrors.NewAggregate(errs)
}

// GetNamespaceLabels gets the labels of the namespace related to the attr.
func (m *Matcher) GetNamespaceLabels(attr admission.Attributes) (map[string]string, error) {
	// If the request itself is creating or updating a namespace, then get the
	// labels from attr.Object, because namespaceLister doesn't have the latest
	// namespace yet.
	//

#include "tensorflow/core/lib/monitoring/counter.h"
#include "tsl/platform/statusor.h"

namespace tensorflow {
namespace {

auto* tf_core_op_expansion_graph_counter =
    monitoring::Counter<0>::New("/tensorflow/core/op_expansion/graph_counter",
                                "The number of graphs being op expanded.");
}  // namespace

namespace tfr {

MlirOptimizationPassState GraphDecomposePass::GetPassState(

		name      string
		yml       string
		namespace string
		expected  string
	}{
		{
			"no namespace",
			`metadata:
  name: foo`,
			"default",
			`metadata:
  name: foo
  namespace: default`,
		},
		{
			"empty namespace",
			`metadata:
  name: foo
  namespace: ""`,
			"default",
			`metadata:
  name: foo
  namespace: default`,
		},
		{
			"existing namespace",

	a1 = &fakeInstance{Cluster: cls1, Namespace: namespace.Static("echo"), Service: "a"}
	// simple pod with different svc
	b1 = &fakeInstance{Cluster: cls1, Namespace: namespace.Static("echo"), Service: "b"}
	// virtual machine
	vm1 = &fakeInstance{Cluster: cls1, Namespace: namespace.Static("echo"), Service: "vm", DeployAsVM: true}
	// headless

	framework.
		NewTest(t).
		RequiresSingleCluster().
		Run(func(t framework.TestContext) {
			g := NewWithT(t)

			ns1 := namespace.NewOrFail(t, t, namespace.Config{
				Prefix: "istioctl-analyze-1",
				Inject: true,
			})
			ns2 := namespace.NewOrFail(t, t, namespace.Config{
				Prefix: "istioctl-analyze-2",
				Inject: true,
			})

			applyFileOrFail(t, ns1.Name(), gatewayFile)

					Name:      "test1",
					Namespace: "foo",
				},
				InvolvedObject: core.ObjectReference{
					Namespace: "bar",
					Kind:      "Pod",
				},
			},
			false,
		}, {
			&core.Event{
				ObjectMeta: metav1.ObjectMeta{
					Name:      "test2",
					Namespace: "aoeu-_-aoeu",
				},
				InvolvedObject: core.ObjectReference{
					Namespace: "aoeu-_-aoeu",
					Kind:      "Pod",
				},

        expect:
        NamespaceBuilder.toNamespace(value) == namespace

        where:
        value      | namespace
        "123"      | ""
        "1thing"   | "thing"
        "1a 2b 3c" | "a_b_c"
    }

    def "maps separator chars"() {
        expect:
        NamespaceBuilder.toNamespace(value) == namespace

        where:
        value      | namespace
        ":"        | ""
        "  "       | ""

    namespace: istio-system
  to:
  - group: ""
    kind: Secret
`,
			expectations: []res{
				// allow cross namespace
				{"kubernetes-gateway://default/wildcard-example-com-cert", "istio-system", true},
				// denied same namespace. We do not implicitly allow (in this code - higher level code does)
				{"kubernetes-gateway://default/wildcard-example-com-cert", "default", false},
				// denied namespace

		{pod.Name, se.Name, pod.Namespace, pod.Status.PodIP},
		{pod2.Name, se.Name, pod2.Namespace, pod2.Status.PodIP},
		{pod.Name, svc.Name, pod.Namespace, pod.Status.PodIP},
		{pod2.Name, svc.Name, pod2.Namespace, pod2.Status.PodIP},
	})
}

func TestCollectionJoinSync(t *testing.T) {
	c := kube.NewFakeClient(&corev1.Pod{
		ObjectMeta: metav1.ObjectMeta{
			Name:      "name",
			Namespace: "namespace",

#include "tensorflow/core/platform/types.h"

namespace tensorflow {
namespace generator {
namespace cpp {

NamespaceRenderer::NamespaceRenderer(RendererContext context)
    : Renderer(context) {}

void NamespaceRenderer::Open() {
  for (const string& ns : context_.cpp_config.namespaces) {
    CodeLine("namespace " + ns + " {");
  }
}

void NamespaceRenderer::Close() {