b: `apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: istio-ingressgateway
  namespace: istio-system
  labels:
    app: istio-ingressgateway
    release: istio`,
			want: `metadata:
  labels:
    app: <empty> -> istio-ingressgateway (ADDED)
  name: <empty> -> istio-ingressgateway (ADDED)
`,
		},
		{
			desc: "two missing",
			a: `apiVersion: autoscaling/v2

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  annotations:
    internal.istio.io/gateway-semantics: gateway
    internal.istio.io/gateway-service: istio-ingressgateway.istio-system.svc.domain.suffix
    internal.istio.io/parents: Gateway/gateway/default.istio-system
  creationTimestamp: null
  name: gateway-istio-autogenerated-k8s-gateway-default
  namespace: istio-system
spec:
  servers:
  - hosts:
    - '*/*.domain.example'

                        "metadata": {
                            "filterMetadata": {
                                "istio": {
                                    "workload": "istio-ingressgateway;istio-system;istio-ingressgateway;latest;Kubernetes"
                                }
                            }
                        },
                        "loadBalancingWeight": 1
                    }

      loadBalancingWeight: 1
      metadata:
        filterMetadata:
          istio:
            workload: istio-ingressgateway;istio-system;istio-ingressgateway;latest;Kubernetes
    loadBalancingWeight: 1
    locality: {}
  policy:
    overprovisioningFactor: 140
- clusterName: outbound|443||istio-ingressgateway.istio-system.svc.cluster.local
  endpoints:
  - lbEndpoints:
    - endpoint:
        address:

					ObjectMeta: metav1.ObjectMeta{
						Name:      "ingress",
						Namespace: "default",
						Labels: map[string]string{
							"istio": "ingressgateway",
						},
					},
					Spec: corev1.ServiceSpec{
						Selector: map[string]string{
							"istio": "ingressgateway",
						},
						Ports: []corev1.ServicePort{
							{
								Name:       "http",
								Port:       80,

      ##############
      secretVolumes:
      - name: ingressgateway-certs
        secretName: istio-ingressgateway-certs
        mountPath: /etc/istio/ingressgateway-certs
      - name: ingressgateway-ca-certs
        secretName: istio-ingressgateway-ca-certs
        mountPath: /etc/istio/ingressgateway-ca-certs

      customService: false
      externalTrafficPolicy: ""

      ingressPorts: []

			// Create the same virtual service in two namespaces
			config: `
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: ingressgateway
  namespace: istio-system
spec:
  selector:
    istio: ingressgateway
  servers:
  - hosts:
    - '*.example.com'
    port:
      name: https
      number: 443
      protocol: HTTPS
    tls:
      mode: PASSTHROUGH

          "expr": "(sum(irate(container_cpu_usage_seconds_total{pod=~\"istio-ingressgateway-.*\",container=\"istio-proxy\"}[1m])) / (round(sum(irate(istio_requests_total{source_workload=\"istio-ingressgateway\", reporter=\"source\"}[1m])), 0.001)/1000))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "istio-ingressgateway",
          "refId": "A"
        },
        {

,"resources":{"limits":{"cpu":"2000m","memory":"1024Mi"},"requests":{"cpu":"100m","memory":"128Mi"}}},"secretVolumes":[{"mountPath":"/etc/istio/ingressgateway-certs","name":"ingressgateway-certs","secretName":"istio-ingressgateway-certs"},{"mountPath":"/etc/istio/ingressgateway-ca-certs","name":"ingressgateway-ca-certs","secretName":"istio-ingressgateway-ca-certs"}],"type":"LoadBalancer","zvpn":{"enabled":true,"suffix":"global"}}},"global":{"arch":{"amd64":2,"ppc64le":2,"s390x":2},"certificates"...

,"resources":{"limits":{"cpu":"2000m","memory":"1024Mi"},"requests":{"cpu":"100m","memory":"128Mi"}}},"secretVolumes":[{"mountPath":"/etc/istio/ingressgateway-certs","name":"ingressgateway-certs","secretName":"istio-ingressgateway-certs"},{"mountPath":"/etc/istio/ingressgateway-ca-certs","name":"ingressgateway-ca-certs","secretName":"istio-ingressgateway-ca-certs"}],"type":"LoadBalancer","zvpn":{"enabled":true,"suffix":"global"}}},"global":{"arch":{"amd64":2,"ppc64le":2,"s390x":2},"certificates"...