name: acme-lb
    group: acme.io
    kind: Parameters
---
apiVersion: v1
kind: Namespace
metadata:
  name: gateway-api-example-ns1
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: my-filter-gateway
  namespace: gateway-api-example-ns1
spec:
  gatewayClassName: filter-lb
  listeners:
    - name: http
      protocol: HTTP
      port: 80
    - name: https

  namespace: istio-config
spec:
  host: "*.local"
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
---
# Services and configs in ns1 namespace
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: http1
  namespace: ns1
spec:
  hosts:
    - http1.ns1.svc.cluster.local
  addresses:
    - 2.1.1.1
  ports:
    - number: 8081
      name: http
      protocol: HTTP2

			proxy: &model.Proxy{
				ID: "pod1.ns1",
				Metadata: &model.NodeMetadata{
					Namespace: "default",
				},
			},
		},
		{
			name: "invalid id: namespace mismatch",
			proxy: &model.Proxy{
				ID: "pod1.ns1",
				Metadata: &model.NodeMetadata{
					Namespace: "ns1",
				},
			},
			expectedKey: types.NamespacedName{Namespace: "ns1", Name: "pod1"},
		},
	}

	}
}

func TestUnmarshalSelectionSpec(t *testing.T) {
	include := "ns1,ns2/d1,d2/p1,p2/l1=lv1,l2=lv2/a1=av1,a2=av2/c1,c2"
	want := &SelectionSpec{
		Namespaces:  []string{"ns1", "ns2"},
		Deployments: []string{"d1", "d2"},
		Pods:        []string{"p1", "p2"},
		Labels: map[string]string{
			"l1": "lv1",
			"l2": "lv2",
		},

	// We should have only: s1, s3 and s4 secrets in namespaces: ns1 and ns2.
	for _, ns := range []string{"ns1", "ns2", "ns3"} {
		for _, secret := range []string{"s1", "s2", "s3", "s4", "s5", "s6", "s20", "s40", "s50"} {
			shouldExist :=
				(secret == "s1" || secret == "s3" || secret == "s4" || secret == "s40") && (ns == "ns1" || ns == "ns2")
			checkObject(t, store, ns, secret, shouldExist)
		}
	}

		want      host.Names
	}{
		{
			[]string{"ns1/foo.com", "ns2/bar.com"},
			"ns1",
			host.Names{"foo.com"},
		},
		{
			[]string{"ns1/foo.com", "ns2/bar.com"},
			"ns3",
			host.Names{},
		},
		{
			[]string{"ns1/foo.com", "*/bar.com"},
			"ns1",
			host.Names{"foo.com", "bar.com"},
		},
		{
			[]string{"ns1/foo.com", "*/bar.com"},
			"ns3",
			host.Names{"bar.com"},

---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
  name: allow-ns1-gateways-to-ref-secrets
  namespace: gateway-api-example-ns2
spec:
  from:
  - group: gateway.networking.k8s.io
    kind: Gateway
    namespace: gateway-api-example-ns1
  to:
  - group: ""

  namespace: ns1
spec:
  metrics:
  - providers:
    - name: prometheus
    overrides:
    - match:
        metric: ALL_METRICS
      disabled: false
---
apiVersion: telemetry.istio.io/v1alpha1
kind: Telemetry
metadata:
  name: has-selector
  namespace: ns1
spec:

			},
			roles: []*rbacv1.Role{
				newRole("admin", "ns1", newRule("get", "*", "Pods", "*")),
			},
			roleBindings: []*rbacv1.RoleBinding{
				newRoleBinding("ns1", "admin", bindToRole, "User:admin", "Group:admins"),
			},
			actionsToSubjects: []actionToSubjects{
				{
					&defaultAttributes{"", "", "get", "Pods", "", "ns1", ""},
					[]rbacv1.Subject{

					{
						Settings: &meshconfig.MeshConfig_ServiceSettings_Settings{
							ClusterLocal: true,
						},
						Hosts: []string{
							"*.ns1.svc.cluster.local",
							"*.ns2.svc.cluster.local",
						},
					},
				},
			},
			host:     "s.ns1.svc.cluster.local",
			expected: true,
		},
		{
			name: "local 2",
			m: &meshconfig.MeshConfig{