ServiceImport                  = schema.GroupVersionResource{Group: "multicluster.x-k8s.io", Version: "v1alpha1", Resource: "serviceimports"}
	AuthorizationPolicy            = schema.GroupVersionResource{Group: "security.istio.io", Version: "v1beta1", Resource: "authorizationpolicies"}

var skippedNdsConfigs = sets.New(
	kind.Gateway,
	kind.VirtualService,
	kind.DestinationRule,
	kind.Secret,
	kind.Telemetry,
	kind.EnvoyFilter,
	kind.WorkloadEntry,
	kind.WorkloadGroup,
	kind.AuthorizationPolicy,
	kind.RequestAuthentication,
	kind.PeerAuthentication,
	kind.WasmPlugin,
	kind.ProxyConfig,
	kind.MeshConfig,

	kind.KubernetesGateway,
	kind.HTTPRoute,
	kind.TCPRoute,
	kind.TLSRoute,

	default:
		panic(fmt.Sprintf("Unknown type %T", ptr.Empty[T]()))
	}
}

func gvrToObject(g schema.GroupVersionResource) runtime.Object {
	switch g {
	case gvr.AuthorizationPolicy:
		return &apiistioioapisecurityv1beta1.AuthorizationPolicy{}
	case gvr.CertificateSigningRequest:
		return &k8sioapicertificatesv1.CertificateSigningRequest{}
	case gvr.ConfigMap:
		return &k8sioapicorev1.ConfigMap{}

    protoPackage: "istio.io/api/mesh/v1alpha1"
    synthetic: true

  - kind: AuthorizationPolicy
    plural: "authorizationpolicies"
    group: "security.istio.io"
    version: "v1beta1"
    versionAliases:
      - "v1"
    proto: "istio.security.v1beta1.AuthorizationPolicy"
    protoPackage: "istio.io/api/security/v1beta1"
    statusProto: "istio.meta.v1alpha1.IstioStatus"

}

var _ model.XdsDeltaResourceGenerator = &CdsGenerator{}

// Map of all configs that do not impact CDS
var skippedCdsConfigs = sets.New(
	kind.Gateway,
	kind.WorkloadEntry,
	kind.WorkloadGroup,
	kind.AuthorizationPolicy,
	kind.RequestAuthentication,
	kind.Secret,
	kind.Telemetry,
	kind.WasmPlugin,
	kind.ProxyConfig,
	kind.DNSName,

	kind.KubernetesGateway,
)

	case 3:
		in := &networking.Sidecar{}
		err = f.GenerateStruct(in)
		if err != nil {
			return 0
		}
		c.Spec = in
		_, _ = validation.ValidateSidecar(c)
	case 4:
		in := &security_beta.AuthorizationPolicy{}
		err = f.GenerateStruct(in)
		if err != nil {
			return 0
		}
		c.Spec = in
		_, _ = validation.ValidateAuthorizationPolicy(c)
	case 5:
		in := &security_beta.RequestAuthentication{}

		contains map[ConfigKey]bool
	}{
		{"AuthorizationPolicy in the same ns as workload", []string{"*/*"}, map[ConfigKey]bool{
			{kind.AuthorizationPolicy, "authz", "default"}: true,
		}},
		{"AuthorizationPolicy in a different ns from workload", []string{"*/*"}, map[ConfigKey]bool{
			{kind.AuthorizationPolicy, "authz", "ns1"}: false,
		}},
		{"AuthorizationPolicy in the root namespace", []string{"*/*"}, map[ConfigKey]bool{

				{
					Meta: config.Meta{Name: uuid.NewString(), Namespace: "istio-system", GroupVersionKind: gvk.AuthorizationPolicy},
					Spec: &security.AuthorizationPolicy{},
				},
				{
					Meta: config.Meta{Name: uuid.NewString(), Namespace: "istio-system", GroupVersionKind: gvk.AuthorizationPolicy},
					Spec: &security.AuthorizationPolicy{
						Action:       security.AuthorizationPolicy_CUSTOM,

					}, `
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: policy-waypoint
spec:
  targetRefs:
  # affects Waypoints
  - kind: Service
    group: core
    name: "{{ .Destination }}"
`+tc.spec+`
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: policy
spec:
  # affects zTunnels and Sidecars

	var updatedPolicies sets.Set[model.ConfigKey]
	if len(req.ConfigsUpdated) != 0 {
		updatedPolicies = model.ConfigsOfKind(req.ConfigsUpdated, kind.AuthorizationPolicy)
		// Convert the actual Kubernetes PeerAuthentication policies to the synthetic ones
		// by adding the prefix
		//
		// This is needed because the handler that produces the ConfigUpdate blindly sends