Name         string          `json:"name"`
	Namespace    string          `json:"namespace"`
	Hostname     string          `json:"hostname"`
	Addresses    []string        `json:"vips"`
	Ports        map[string]int  `json:"ports"`
	LoadBalancer *LoadBalancer   `json:"loadBalancer"`
	Waypoint     *GatewayAddress `json:"waypoint"`
}

type PolicyMatch struct {
	Namespaces          []StringMatch `json:"namespaces,omitempty"`

	pluginServer := startCniPluginServer(ctx, "/tmp/test.sock", handlers, dpServer)

	// label the namespace
	labelsPatch := []byte(fmt.Sprintf(`{"metadata":{"labels":{"%s":"%s"}}}`,
		constants.DataplaneModeLabel, constants.DataplaneModeAmbient))
	_, err := client.Kube().CoreV1().Namespaces().Patch(ctx, ns.Name,
		types.MergePatchType, labelsPatch, metav1.PatchOptions{})
	assert.NoError(t, err)

	for _, namespace := range ignoredNamespaces.UnsortedList() {
		// Create namespace in ignored list, make sure its not created
		createNamespace(t, client.Kube(), namespace, newData)
		// Configmap in that namespace should not do anything either
		createConfigMap(t, client.Kube(), "not-root", namespace, "k")
		expectConfigMapNotExist(t, nc.configmaps, namespace)
	}
}

			serviceaccounts = append(serviceaccounts, kubeToIstioServiceAccount(ksa, svc.Namespace, mesh))
		}
	}
	if svc.Annotations[annotation.NetworkingExportTo.Name] != "" {
		namespaces := strings.Split(svc.Annotations[annotation.NetworkingExportTo.Name], ",")
		exportTo = sets.NewWithLength[visibility.Instance](len(namespaces))
		for _, ns := range namespaces {
			exportTo.Insert(visibility.Instance(ns))
		}
	}

    gateway.networking.k8s.io/gateway-name: namespace
    istio.io/gateway-name: namespace
    topology.istio.io/network: network-1
  name: namespace
  namespace: default
  ownerReferences:
  - apiVersion: gateway.networking.k8s.io/v1beta1
    kind: Gateway
    name: namespace
    uid: ""
spec:
  selector:
    matchLabels:
      gateway.networking.k8s.io/gateway-name: namespace
  template:
    metadata:

    gateway.networking.k8s.io/gateway-name: namespace
    istio.io/gateway-name: namespace
    topology.istio.io/network: network-1
  name: namespace
  namespace: default
  ownerReferences:
  - apiVersion: gateway.networking.k8s.io/v1beta1
    kind: Gateway
    name: namespace
    uid: ""
spec:
  selector:
    matchLabels:
      gateway.networking.k8s.io/gateway-name: namespace
  template:
    metadata:

		} else if field == "metadata.namespace" {
			// list pods in the namespace. i.e. /api/v1/namespaces/default/pods
			if namespace, isNamespaceScope := isNamespaceScopedRequest(ctx); isNamespaceScope {
				result = append(result, MatchValue{IndexName: FieldIndex(field), Value: namespace})
			}
		}
	}
	for _, label := range s.IndexLabels {

}

// Namespace returns the namespace for the component. It follows these rules:
// 1. If DefaultNamespace is unset, log and error and return the empty string.
// 2. If the feature and component namespaces are unset, return DefaultNamespace.
// 3. If the feature namespace is set but component name is unset, return the feature namespace.
// 4. Otherwise return the component namespace.

					return true, nil
				}
			}
		}
	}
	return false, fmt.Errorf("no interface has the address %s", targetAddr)
}

// getPodNetNs finds the network namespace for a given pod. There is not a great way to do this. Network namespaces live
// under the procfs, /proc/<pid>/ns/net. In majority of cases, this is not used directly, but is rather bind mounted to

        - name: ISTIO_META_INTERCEPTION_MODE
          value: REDIRECT
        - name: ISTIO_META_WORKLOAD_NAME
          value: default-istio
        - name: ISTIO_META_OWNER
          value: kubernetes://apis/apps/v1/namespaces/default/deployments/default-istio
        - name: ISTIO_META_MESH_ID
          value: cluster.local
        - name: TRUST_DOMAIN
          value: cluster.local
        image: test/proxyv2:test