ResourceType string
	// Name is the name of the secret
	Name string
	// Namespace is the namespace the secret resides in. For implicit namespace references (such as in KubernetesSecretType),
	// this will be resolved to the appropriate namespace. As a result, this should never be empty.
	Namespace string
	// ResourceName is the original name of the resource
	ResourceName string

		"Istio system namespace")
	return r
}

// Namespace returns the namespace flag value.
func (r *RootFlags) Namespace() string {
	return *r.namespace
}

// IstioNamespace returns the istioNamespace flag value.
func (r *RootFlags) IstioNamespace() string {
	return *r.istioNamespace
}

// DefaultNamespace returns the default namespace to use.
func (r *RootFlags) DefaultNamespace() string {

	workloadLabels := selectionOpts.WorkloadLabels
	namespace := selectionOpts.Namespace
	configs := make([]*config.Config, 0)
	var lookupInNamespaces []string
	if namespace != rootNamespace {
		// Only check the root namespace if the (workload) namespace is not already the root namespace
		// to avoid double inclusion.
		lookupInNamespaces = []string{namespace, rootNamespace}
	} else {
		lookupInNamespaces = []string{namespace}

	PluginName = "NamespaceLifecycle"
	// how long a namespace stays in the force live lookup cache before expiration.
	forceLiveLookupTTL = 30 * time.Second
	// how long to wait for a missing namespace before re-checking the cache (and then doing a live lookup)
	// this accomplishes two things:
	// 1. It allows a watch-fed cache time to observe a namespace creation event
	// 2. It allows time for a namespace creation to distribute to members of a storage cluster,

			resource:         "kubernetes-gateway://namespace/cert",
			defaultNamespace: "default",
			expected: SecretResource{
				ResourceType: KubernetesGatewaySecretType,
				Name:         "cert",
				Namespace:    "namespace",
				ResourceName: "kubernetes-gateway://namespace/cert",
				Cluster:      "config",
			},
		},
		{
			name:             "kubernetes-gateway without namespace",
			resource:         "kubernetes-gateway://cert",

)

// NamespaceDiscoveryHandler is to handle namespace selected or deselected because of discoverySelectors change,
// rather than namespace add/update/delete event triggered from namespace informer.
func (s *Controller) NamespaceDiscoveryHandler(namespace string, event model.Event) {
	if event == model.EventDelete {
		log.Debugf("Handle event namespace %s deselected", namespace)
	} else {

	if err != nil {
		t.Fatalf("unexpected error: %v", err)
	}

	object, err := storage.Get(ctx, "foo", &metav1.GetOptions{})
	if err != nil {
		t.Errorf("unexpected error: %v", err)
	}
	actual := object.(*api.Namespace)
	if actual.Name != namespace.Name {
		t.Errorf("unexpected namespace: %#v", actual)
	}
	if len(actual.UID) == 0 {

      type: ResolvedRefs
    controllerName: istio.io/gateway-controller
    parentRef:
      name: gateway
      namespace: istio-system
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  creationTimestamp: null
  name: http-not-selected
  namespace: default
spec: null
status:
  parents:
  - conditions:
    - lastTransitionTime: fake

}

func createTestRequestAuthenticationResource(
	name string, namespace string, selector *selectorpb.WorkloadSelector, targetRef *selectorpb.PolicyTargetReference,
) *config.Config {
	ra := &config.Config{
		Meta: config.Meta{
			GroupVersionKind: gvk.RequestAuthentication,
			Name:             name,
			Namespace:        namespace,
		},
		Spec: &securityBeta.RequestAuthentication{},
	}

			PersistentVolumeSource: corev1.PersistentVolumeSource{
				ISCSI: &corev1.ISCSIPersistentVolumeSource{
					SecretRef: &corev1.SecretReference{
						Name:      "Spec.PersistentVolumeSource.ISCSI.SecretRef",
						Namespace: "iscsi"}}}}},
		{Spec: corev1.PersistentVolumeSpec{
			ClaimRef: &corev1.ObjectReference{Namespace: "claimrefns", Name: "claimrefname"},