metadata:
  name: {{ .To.ServiceName }}-deny
spec:
  selector:
    matchLabels:
      "app": "{{ .To.ServiceName }}"
  action: DENY
  rules:
    - from:
      - source:

    - operation:
        paths: [ "/source-namespace" ]
    when:
    - key: source.namespace
      values: [ "{{ .Allowed.NamespaceName }}" ]
  - to:
      - operation:
          paths: [ "/source-namespace-notValues" ]
    when:
      - key: source.namespace
        notValues: [ "{{ .Denied.NamespaceName }}" ]
---

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:

			}
		}
		return false
	}
}

// Namespace matches instances within the given namespace name.
func Namespace(n namespace.Instance) Matcher {
	return NamespaceName(n.Name())
}

// NamespaceName matches instances within the given namespace name.
func NamespaceName(ns string) Matcher {
	return func(i echo.Instance) bool {
		return i.Config().Namespace.Name() == ns
	}
}

	}

	return nil
}

func (p *Plugin) getNamespaceNodeSelectorMap(namespaceName string) (labels.Set, error) {
	namespace, err := p.namespaceLister.Get(namespaceName)
	if errors.IsNotFound(err) {
		namespace, err = p.defaultGetNamespace(namespaceName)
		if err != nil {
			if errors.IsNotFound(err) {
				return nil, err
			}
			return nil, errors.NewInternalError(err)

func ConfigFuture(custom *[]Config) ConfigGetter {
	return func() []Config {
		return *custom
	}
}

// NamespaceName returns the string name of the namespace.
func (c Config) NamespaceName() string {
	return c.NamespacedName().NamespaceName()
}

// NamespacedName returns the namespaced name for the service.
func (c Config) NamespacedName() NamespacedName {
	return NamespacedName{

type Instances []Instance

func (i Instances) ServiceName() string {
	return i.Config().Service
}

func (i Instances) NamespaceName() string {
	return i.Config().NamespaceName()
}

func (i Instances) ServiceAccountName() string {
	return i.Config().ServiceAccountName()
}

func (i Instances) ClusterLocalFQDN() string {
	return i.Config().ClusterLocalFQDN()

	cfg := echo.Config(f)
	_ = cfg.FillDefaults(nil)
	return cfg
}

func (f fakeInstance) ServiceName() string {
	return f.Config().Service
}

func (f fakeInstance) NamespaceName() string {
	return f.Config().NamespaceName()
}

func (f fakeInstance) ServiceAccountName() string {
	return f.Config().ServiceAccountName()
}

func (f fakeInstance) ClusterLocalFQDN() string {

	}
}

func testSyncNamespaceThatIsTerminating(t *testing.T, versions *metav1.APIVersions) {
	now := metav1.Now()
	namespaceName := "test"
	testNamespacePendingFinalize := &v1.Namespace{
		ObjectMeta: metav1.ObjectMeta{
			Name:              namespaceName,
			ResourceVersion:   "1",
			DeletionTimestamp: &now,
		},
		Spec: v1.NamespaceSpec{
			Finalizers: []v1.FinalizerName{"kubernetes"},
		},

	return result
}

// CalculateUsage calculates and returns the requested ResourceList usage.
// If an error is returned, usage only contains the resources which encountered no calculation errors.
func CalculateUsage(namespaceName string, scopes []corev1.ResourceQuotaScope, hardLimits corev1.ResourceList, registry Registry, scopeSelector *corev1.ScopeSelector) (corev1.ResourceList, error) {
	// find the intersection between the hard resources on the quota

	cfg := echo.Config(f)
	_ = cfg.FillDefaults(nil)
	return cfg
}

func (f fakeInstance) ServiceName() string {
	return f.Config().Service
}

func (f fakeInstance) NamespaceName() string {
	return f.Config().NamespaceName()
}

func (f fakeInstance) ServiceAccountName() string {
	return f.Config().ServiceAccountName()
}

func (f fakeInstance) ClusterLocalFQDN() string {