log.Debugf("Switch selected namespace policy to %s.%s (%v)", cfg.Name, cfg.Namespace, cfg.CreationTimestamp)
					namespaceCfg = cfg
				}
			}
		} else if cfg.Namespace != rootNamespace {
			if workloadCfg == nil || cfg.CreationTimestamp.Before(&workloadCfg.CreationTimestamp) {
				log.Debugf("Switch selected workload policy to %s.%s (%v)", cfg.Name, cfg.Namespace, cfg.CreationTimestamp)
				workloadCfg = cfg
			}
		}

		c.Namespaces = make([]namespace.Getter, c.NamespaceCount)
		if c.NamespaceCount == 1 {
			// If only using a single namespace, preserve the "echo" prefix.
			g.Go(func() error {
				ns, err := namespace.New(ctx, namespace.Config{
					Inject: !ctx.Settings().AmbientEverywhere,
					Prefix: "echo",
					Labels: nsLabels,
				})
				if err != nil {
					return err
				}
				c.Namespaces[0] = namespace.Future(&ns)

#include "mlir/IR/Operation.h"  // from @llvm-project

namespace tensorflow {
namespace tf2xla {
namespace internal {

// Returns true if the op has a valid namespace during clustering & tf dialect
// to executor components of the Bridge.
bool IsInBridgeAcceptableDialects(mlir::Operation* op);

}  // namespace internal
}  // namespace tf2xla
}  // namespace tensorflow

)

// TestPodAdmission verifies various scenarios involving pod/namespace/global node label selectors
func TestPodAdmission(t *testing.T) {
	namespace := &corev1.Namespace{
		ObjectMeta: metav1.ObjectMeta{
			Name:      "testNamespace",
			Namespace: "",
		},
	}

	mockClient := fake.NewSimpleClientset(namespace)
	handler, informerFactory, err := newHandlerForTest(mockClient)
	if err != nil {

			meta: metav1.ObjectMeta{
				Name:        "no-policy",
				Namespace:   "test-namespace",
				Annotations: map[string]string{},
			},
			want: true,
		},
		{
			config: &Config{
				Policy: InjectionPolicyEnabled,
			},
			podSpec: podSpec,
			meta: metav1.ObjectMeta{
				Name:      "default-policy",
				Namespace: "test-namespace",
			},
			want: true,
		},
		{
			config: &Config{

}

type proxyConfigInstance struct {
	namespace string
	config    string
}

func TestProxyConfig(t *testing.T) {
	framework.NewTest(t).
		RequireIstioVersion("1.13").
		Run(func(ctx framework.TestContext) {
			ns := namespace.NewOrFail(ctx, ctx, namespace.Config{
				Prefix: "pc-test",
				Inject: true,
			})
			cases := []struct {
				name string
				// namespace, labels, and annotations for the echo instance

		if r := cmp.Compare(a.Info.Namespace, b.Info.Namespace); r != 0 {
			return r
		}
		return cmp.Compare(a.Info.Namespace, b.Info.Namespace)
	})
	for _, wl := range workloads {
		if filter.Namespace != "" && filter.Namespace != wl.Info.Namespace {
			continue
		}
		name := fmt.Sprintf("%s.%s", wl.Info.Name, wl.Info.Namespace)
		if filter.Direction != "outbound" {

func (refs AllowedReferences) SecretAllowed(resourceName string, namespace string) bool {
	p, err := creds.ParseResourceName(resourceName, "", "", "")
	if err != nil {
		log.Warnf("failed to parse resource name %q: %v", resourceName, err)
		return false
	}
	from := Reference{Kind: gvk.KubernetesGateway, Namespace: k8s.Namespace(namespace)}
	to := Reference{Kind: gvk.Secret, Namespace: k8s.Namespace(p.Namespace)}
	allow := refs[from][to]
	if allow == nil {

kind: VirtualService
metadata:
  name: productpage
  namespace: foo
spec:
  hosts:
  - '*.productpage' # should generate an error as this conflicts with VirtualService bar/productpage
  http:
  - route:
    - destination:
        host: productpage
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: productpage
  namespace: bar
spec:
  hosts:

# TODO(user): Resolve cycles

NAMESPACE com.google.common.collect.testing
NAMESPACE com.google.common.collect.testing.google
NAMESPACE com.google.common.escape
NAMESPACE com.google.common.escape.testing
NAMESPACE com.google.common.io
NAMESPACE com.google.common.net
NAMESPACE com.google.common.testing

# Allow our dependencies for now.
NAMESPACE junit.framework
NAMESPACE org.junit

# ***** REAL CYCLES *****