// Label (RFC 1123) validation.
  // +optional
  optional string hostname = 3;

  // targetRef is a reference to a Kubernetes object that represents this
  // endpoint.
  // +optional
  optional .k8s.io.api.core.v1.ObjectReference targetRef = 4;

  // topology contains arbitrary topology information associated with the
  // endpoint. These key/value pairs must conform with the label format.

			if postIndex < 0 {
				return ErrInvalidLengthGenerated
			}
			if postIndex > l {
				return io.ErrUnexpectedEOF
			}
			if m.TargetRef == nil {
				m.TargetRef = &v1.ObjectReference{}
			}
			if err := m.TargetRef.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
				return err
			}
			iNdEx = postIndex
		case 5:
			if wireType != 2 {

  // Label (RFC 1123) validation.
  // +optional
  optional string hostname = 3;

  // targetRef is a reference to a Kubernetes object that represents this
  // endpoint.
  // +optional
  optional .k8s.io.api.core.v1.ObjectReference targetRef = 4;

  // deprecatedTopology contains topology information part of the v1beta1
  // API. This field is deprecated, and will be removed when the v1beta1

			t.NewSubTest("enabled").Run(func(t framework.TestContext) {
				applyTelemetryResource(t, true)
				runAccessLogsTests(t, true, false)
				deleteTelemetryResource(t, true)
			})
			t.NewSubTest("enabled-with-targetref").Run(func(t framework.TestContext) {
				args := map[string]any{
					"To":                GetTarget().(echo.Instances),
					"TargetGatewayName": GetTarget().ServiceName() + "-gateway",

		telemetryKey: telemetryKey{
			Workload: namespacedName,
		},
		Logging: []*tpb.AccessLogging{
			emptyEnvoyLogging,
		},
	}
	validTelemetryConfigurationWithTargetRef := &tpb.Telemetry{
		TargetRef: &v1beta1.PolicyTargetReference{
			Group: gvk.KubernetesGateway.Group,
			Kind:  gvk.KubernetesGateway.Kind,
			Name:  "my-gateway",
		},
		Tracing: []*tpb.Tracing{
			emptyStackDriverTracing,
		},

			Namespace: service.Namespace,
			Labels: map[string]string{
				discoveryv1.LabelServiceName: service.Name,
			},
		},
		Endpoints: []discoveryv1.Endpoint{{
			Addresses: []string{pod.Status.PodIP},
			TargetRef: &v1.ObjectReference{
				Kind:      "Pod",
				Namespace: pod.Namespace,
				Name:      pod.Name,
			},
		}},
		Ports: []discoveryv1.EndpointPort{{Name: ptr.Of("http"), Port: ptr.Of(int32(80))}},
	}

		"If disabled, Gateway API gateways will ignore workloadSelector policies, only"+
			"applying policies that select the gateway with a targetRef.").Get()

	// Useful for IPv6-only EKS clusters. See https://aws.github.io/aws-eks-best-practices/networking/ipv6/ why it assigns an additional IPv4 NAT address.

					{
						Name: "envoy",
					},
				},
				Disabled: &wrappers.BoolValue{
					Value: true,
				},
			},
		},
	}
	targetRefClient := &tpb.Telemetry{
		TargetRef: &v1beta1.PolicyTargetReference{
			Group: gvk.KubernetesGateway.Group,
			Kind:  gvk.KubernetesGateway.Kind,
			Name:  "my-gateway",
		},
		AccessLogging: []*tpb.AccessLogging{
			{

}

func convertAuthorizationPolicy(rootns string, obj *securityclient.AuthorizationPolicy) *security.Authorization {
	pol := &obj.Spec

	polTargetRef := model.GetTargetRefs(pol)
	if len(polTargetRef) > 0 {
		// TargetRef is not intended for ztunnel
		return nil
	}

	scope := security.Scope_WORKLOAD_SELECTOR
	if pol.GetSelector() == nil {
		scope = security.Scope_NAMESPACE
		// TODO: TDA
		if rootns == obj.Namespace {

  - name: "IneffectiveSelector"
    code: IST0166
    level: Warning
    description: "Selector has no effect when applied to Kubernetes Gateways."
    template: "Ineffective selector on Kubernetes Gateway %s. Use the TargetRef field instead."
    args:
      - name: gateway
        type: string

  - name: "IneffectivePolicy"
    code: IST0167
    level: Warning
    description: "The policy applied has no impact."