expected: newWatchIdentifier("", "pods", "foo", ""),
		},
		{
			name:     "watch single object",
			request:  httpRequest("GET", "/api/v1/namespaces/foo/pods", "watch=true&fieldSelector=metadata.name=mypod"),
			expected: newWatchIdentifier("", "pods", "foo", "mypod"),
		},
		{
			name:     "watch single cluster-scoped object",
			request:  httpRequest("GET", "/api/v1/namespaces", "watch=true&fieldSelector=metadata.name=myns"),

			return c.Istio().NetworkingV1alpha3().Sidecars(opts.Namespace).Watch(context.Background(), options)
		}
	case gvr.StatefulSet:
		l = func(options metav1.ListOptions) (runtime.Object, error) {
			return c.Kube().AppsV1().StatefulSets(opts.Namespace).List(context.Background(), options)
		}
		w = func(options metav1.ListOptions) (watch.Interface, error) {

		var ret []watch.Event
		for _, createdPod := range createdInitialPods {
			ret = append(ret, watch.Event{Type: watch.Added, Object: createdPod})
		}
		return ret
	}
	initialEventsEndFromLastCreatedPod := func(createdInitialPods []*example.Pod) []watch.Event {
		return []watch.Event{{
			Type: watch.Bookmark,
			Object: &example.Pod{

    resources: ["customresourcedefinitions"]
    verbs: ["get", "list", "watch"]

  # discovery and routing
  - apiGroups: [""]
    resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["discovery.k8s.io"]
    resources: ["endpointslices"]
    verbs: ["get", "list", "watch"]

{{- if .Values.pilot.taint.enabled }}
  - apiGroups: [""]

			if !ok {
				// The underlying channel was closed, cancel our context
				d.cancel()
				return
			}
			switch recv.Type {
			case watch.Added, watch.Modified, watch.Deleted, watch.Bookmark:
				d.decorator(recv.Object)
				send = recv
			case watch.Error:
				send = recv
			}
			select {
			case d.resultCh <- send:
				// propagated event successfully
			case <-ctx.Done():

    resources: ["gateways"]
    verbs: ["get", "watch", "list"]
  - apiGroups: ["apiextensions.k8s.io"]
    resources: ["customresourcedefinitions"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["discovery.k8s.io"]
    resources: ["endpointslices"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["{{ $mcsAPIGroup }}"]
    resources: ["serviceexports"]
    verbs: ["get", "list", "watch", "create", "delete"]

			expectedObj:             ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, ResourceVersionMatch: "m"},
		},
		{
			name:                    "no-op, Watch=false",
			watchListFeatureEnabled: true,
			targetObj:               ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything()},

                "create",
                "delete",
                "deletecollection",
                "get",
                "list",
                "patch",
                "update",
                "watch"
              ]
            }
          ],
          "version": "v1"
        }
      ]
    },
    {
      "metadata": {
        "creationTimestamp": null,
        "name": "apps"
      },

    - watch
  - apiGroups:
    - policy
    resources:
    - poddisruptionbudgets
    - poddisruptionbudgets/status
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - networking.k8s.io
    resources:
    - ingresses
    - ingresses/status
    - networkpolicies
    verbs:
    - get
    - list
    - watch
- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole

    resources: ["customresourcedefinitions"]
    verbs: ["get", "list", "watch"]

  # discovery and routing
  - apiGroups: [""]
    resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["discovery.k8s.io"]
    resources: ["endpointslices"]
    verbs: ["get", "list", "watch"]

{{- if .Values.pilot.taint.enabled }}
  - apiGroups: [""]