"namespaceSelector": {
        "matchLabels": {
          "matchLabelsKey": "matchLabelsValue"
        },
        "matchExpressions": [
          {
            "key": "keyValue",
            "operator": "operatorValue",
            "values": [
              "valuesValue"
            ]
          }
        ]
      },
      "objectSelector": {
        "matchLabels": {
          "matchLabelsKey": "matchLabelsValue"

      - key: keyValue
        operator: operatorValue
        values:
        - valuesValue
      matchLabels:
        matchLabelsKey: matchLabelsValue
    objectSelector:
      matchExpressions:
      - key: keyValue
        operator: operatorValue
        values:
        - valuesValue
      matchLabels:
        matchLabelsKey: matchLabelsValue
    resourceRules:
    - apiGroups:
      - apiGroupsValue

			map[string]string{"c": "d"},
			field.ErrorList{
				&field.Error{
					Type:  field.ErrorTypeInvalid,
					Field: field.NewPath("spec").Child("selector").String(),
					BadValue: &metav1.LabelSelector{
						MatchLabels:      map[string]string{"c": "d"},
						MatchExpressions: []metav1.LabelSelectorRequirement{},
					},
					Detail: "field is immutable",
				},
			},
		},
		{
			genericapirequest.RequestInfo{

	matchLabels := map[string]string{"foo": "bar"}
	selector1 := &metav1.LabelSelector{MatchLabels: matchLabels}
	labelsSelector1, _ := metav1.LabelSelectorAsSelector(selector1)

	matchExpressions := []metav1.LabelSelectorRequirement{
		{Key: "foo", Operator: metav1.LabelSelectorOpIn, Values: []string{"foo"}},
	}
	selector2 := &metav1.LabelSelector{MatchLabels: matchLabels, MatchExpressions: matchExpressions}

					expression.Key,
					msg,
				),
			)
		}
	}

	// use of deprecated node labels in matchLabels
	for label := range nodeSelector.MatchLabels {
		if msg, deprecated := GetNodeLabelDeprecatedMessage(label); deprecated {
			warnings = append(warnings, fmt.Sprintf("%s: %s", fieldPath.Child("matchLabels").Child(label), msg))
		}
	}
	return warnings
}

  selector:
    app: tcp-echo
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: tcp-echo-v1
  labels:
    app: tcp-echo
    version: v1
spec:
  replicas: 1
  selector:
    matchLabels:
      app: tcp-echo
      version: v1
  template:
    metadata:
      labels:
        app: tcp-echo
        version: v1
    spec:
      containers:
      - name: tcp-echo

					name: "DISABLE with STRICT",
					config: `apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: {{ .To.ServiceName }}-mtls
spec:
  selector:
    matchLabels:
      app: {{ .To.ServiceName }}
  mtls:
    mode: DISABLE
  portLevelMtls:
    {{ (.To.PortForName "tcp-wl-only").WorkloadPort }}:
      mode: STRICT`,
					expected: []expect{
						{

		ObjectMeta: metav1.ObjectMeta{Name: "abc", Namespace: metav1.NamespaceDefault},
		Spec: policy.PodDisruptionBudgetSpec{
			MinAvailable:               &minAvailable,
			Selector:                   &metav1.LabelSelector{MatchLabels: validSelector},
			UnhealthyPodEvictionPolicy: tc.unhealthyPodEvictionPolicy,
		},
	}

	Strategy.PrepareForCreate(ctx, pdb)
	errs := Strategy.Validate(ctx, pdb)
	if len(errs) != 0 {

metadata:
  labels:
    app: metadata-agent
    kubernetes.io/cluster-service: "true"
    addonmanager.kubernetes.io/mode: Reconcile
  name: metadata-agent
  namespace: kube-system
spec:
  selector:
    matchLabels:
      app: metadata-agent
  template:
    metadata:
      labels:
        app: metadata-agent
    spec:
      securityContext:
        seccompProfile:
          type: RuntimeDefault

apiVersion: apps/v1
kind: Deployment
metadata:
  name: skywalking-oap
  namespace: istio-system
  labels:
    app: skywalking-oap
spec:
  selector:
    matchLabels:
      app: skywalking-oap
  template:
    metadata:
      labels:
        app: skywalking-oap
        sidecar.istio.io/inject: "false"
    spec:
      containers:
        - name: skywalking-oap
          image: apache/skywalking-oap-server:9.7.0