func (refs AllowedReferences) SecretAllowed(resourceName string, namespace string) bool {
	p, err := creds.ParseResourceName(resourceName, "", "", "")
	if err != nil {
		log.Warnf("failed to parse resource name %q: %v", resourceName, err)
		return false
	}
	from := Reference{Kind: gvk.KubernetesGateway, Namespace: k8s.Namespace(namespace)}
	to := Reference{Kind: gvk.Secret, Namespace: k8s.Namespace(p.Namespace)}
	allow := refs[from][to]
	if allow == nil {

    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:controller:bootstrap-signer
    namespace: kube-public
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: Role
    name: system:controller:bootstrap-signer
  subjects:
  - kind: ServiceAccount
    name: bootstrap-signer
    namespace: kube-system
- apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    annotations:

{
  "kind": "Namespace",
  "apiVersion": "v1",
  "metadata": {
    "name": "nameValue",
    "generateName": "generateNameValue",
    "namespace": "namespaceValue",
    "selfLink": "selfLinkValue",
    "uid": "uidValue",
    "resourceVersion": "resourceVersionValue",
    "generation": 7,
    "creationTimestamp": "2008-01-01T01:01:01Z",
    "deletionTimestamp": "2009-01-01T01:01:01Z",
    "deletionGracePeriodSeconds": 10,
    "labels": {

{
  "kind": "Namespace",
  "apiVersion": "v1",
  "metadata": {
    "name": "nameValue",
    "generateName": "generateNameValue",
    "namespace": "namespaceValue",
    "selfLink": "selfLinkValue",
    "uid": "uidValue",
    "resourceVersion": "resourceVersionValue",
    "generation": 7,
    "creationTimestamp": "2008-01-01T01:01:01Z",
    "deletionTimestamp": "2009-01-01T01:01:01Z",
    "deletionGracePeriodSeconds": 10,
    "labels": {

			hub:               "foo.io/istio",
			tag:               "1.2.3",
			imagePullSecrets:  []string{"imagePullSecret1,imagePullSecret2"},
			operatorNamespace: "operator-test-namespace",
			watchedNamespaces: "istio-test-namespace1,istio-test-namespace2",
		},
	}

	cmd := "operator dump --hub " + odArgs.common.hub
	cmd += " --tag " + odArgs.common.tag
	cmd += " --imagePullSecrets " + strings.Join(odArgs.common.imagePullSecrets, ",")

              value: "istio-test-namespace1,istio-test-namespace2"
            - name: LEADER_ELECTION_NAMESPACE
              value: "operator-test-namespace"
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: OPERATOR_NAME
              value: "operator-test-namespace"
            - name: WAIT_FOR_RESOURCES_TIMEOUT

	statefulsets := []*appsv1.StatefulSet{}
	namespaces := []corev1.Namespace{}

	for _, o := range objects {
		kind := o.GroupVersionKind().Kind
		switch kind {
		case name.NamespaceStr:
			namespace, err := cs.CoreV1().Namespaces().Get(context.TODO(), o.Name, metav1.GetOptions{})
			if err != nil {
				return false, nil, nil, err
			}
			namespaces = append(namespaces, *namespace)
		case name.DeploymentStr:

    }

    private static NamespaceId ns(String name) {
        return new NamespaceId("http://my.extra.info/${name}", name)
    }

    private static String declareNS(String name) {
        "(new javax.xml.namespace.QName('http://my.extra.info/${name}', '${name}'))"
    }

    private static String sq(String input) {

}

func BenchmarkShouldCallHookWithComplexSelector(b *testing.B) {
	allScopes := v1.AllScopes
	equivalentMatch := v1.Equivalent

	namespace1Labels := map[string]string{"ns": "ns1"}
	namespace1 := corev1.Namespace{
		ObjectMeta: metav1.ObjectMeta{
			Name:   "ns1",
			Labels: namespace1Labels,
		},
	}
	namespaceLister := fakeNamespaceLister{map[string]*corev1.Namespace{"ns": &namespace1}}

revision tag, use 'kubectl label namespace <NAMESPACE> istio.io/rev=%s'
`
	webhookNameHelpStr          = "Name to use for a revision tag's mutating webhook configuration."
	autoInjectNamespacesHelpStr = "If set to true, the sidecars should be automatically injected into all namespaces by default"
)

// options for CLI
var (
	// revision to point tag webhook at