// Only CRD is ready to go by the time we start informers
		clienttest.MakeCRD(t, c, gvr.WasmPlugin)
		c.RunAndWait(stop)

		// Now that CRD is synced, we create the client
		wasm := kclient.NewDelayedInformer[controllers.Object](c, gvr.WasmPlugin, kubetypes.StandardInformer, kubetypes.Filter{})
		wt := clienttest.NewWriter[*istioclient.WasmPlugin](t, c)
		tracker := assert.NewTracker[string](t)

		return "Telemetry"
	case UDPRoute:
		return "UDPRoute"
	case ValidatingWebhookConfiguration:
		return "ValidatingWebhookConfiguration"
	case VirtualService:
		return "VirtualService"
	case WasmPlugin:
		return "WasmPlugin"
	case WorkloadEntry:
		return "WorkloadEntry"
	case WorkloadGroup:
		return "WorkloadGroup"
	default:
		return "Unknown"
	}
}

func MustFromGVK(g config.GroupVersionKind) Kind {

apiVersion: release-notes/v2
kind: feature
area: extensibility
issue: [39345]
releaseNotes:
  - |

		return gvk.VirtualService, true
	case *apiistioioapinetworkingv1alpha3.VirtualService:
		return gvk.VirtualService, true
	case *istioioapiextensionsv1alpha1.WasmPlugin:
		return gvk.WasmPlugin, true
	case *apiistioioapiextensionsv1alpha1.WasmPlugin:
		return gvk.WasmPlugin, true
	case *istioioapinetworkingv1alpha3.WorkloadEntry:
		return gvk.WorkloadEntry, true
	case *apiistioioapinetworkingv1alpha3.WorkloadEntry:

// after applying the Wasm filter.
// At this moment, there is no "fail_open" option in WasmPlugin API. So, we test it using
// EnvoyFilter. When WasmPlugin has a "fail_open" option in the API plane, we need to change
// this test to use the WasmPlugin API
func TestBadWasmWithFailOpen(t *testing.T) {
	framework.NewTest(t).
		Run(func(t framework.TestContext) {

		Spec: &extensions.WasmPlugin{
			Phase: extensions.PluginPhase_AUTHZ,
			Type:  extensions.PluginType_NETWORK,
		},
	},
	{
		Meta: config.Meta{Name: "wasm-network-authn", Namespace: "istio-system", GroupVersionKind: gvk.WasmPlugin},
		Spec: &extensions.WasmPlugin{
			Phase: extensions.PluginPhase_AUTHN,

apiVersion: extensions.istio.io/v1alpha1
kind: WasmPlugin
metadata:
  name: istio.attributegen
spec:
  phase: STATS
  selector:
    matchLabels:
      app: b
  url: {{ .AttributeGenURL }}
  imagePullSecret: reg-cred
  pluginConfig:
    attributes:
    - output_attribute: istio_responseClass
      match:
      - value: 2xx
        condition: response.code >= 200 && response.code <= 299
    - output_attribute: istio_operationId

		key:            "key2",
		dependentTypes: []kind.Kind{kind.Service, kind.EnvoyFilter, kind.WasmPlugin},
		dependentConfigs: []ConfigHash{
			ConfigKey{Kind: kind.Service, Name: "name", Namespace: "namespace"}.HashCode(),
			ConfigKey{Kind: kind.EnvoyFilter, Name: "name", Namespace: "namespace"}.HashCode(),
			ConfigKey{Kind: kind.WasmPlugin, Name: "name", Namespace: "namespace"}.HashCode(),
		},
	}

	c := newTypedXdsCache[uint64]()

spec:
  selector:
    matchLabels:
      gateway.networking.k8s.io/gateway-name: bookinfo-gateway
---
# only selector is set, should be ineffective
apiVersion: extensions.istio.io/v1alpha1
kind: WasmPlugin
metadata:
  name: wasmplugin-ineffective
  namespace: default
spec:
  selector:
    matchLabels:
      gateway.networking.k8s.io/gateway-name: bookinfo-gateway
  url: google.com
---

apiVersion: release-notes/v2
kind: feature
area: extensibility
issue: []
releaseNotes:
  - |