regex: .*/ns/namespaces1/.*
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: .*/ns/namespaces2/.*
      ns[foo]-policy[httpbin-8]-rule[0]:
        permissions:
        - andRules:
            rules:
            - any: true
        principals:
        - andIds:
            ids:

	// Namespace1 is used as the default namespace for reachability tests and other tests which can reuse the same config for echo instances
	Namespace1 namespace.Instance
	// Namespace2 is used by most authorization test cases within authorization_test.go
	Namespace2 namespace.Instance
	// Namespace3 is used by TestAuthorization_Conditions and there is one C echo instance deployed
	Namespace3    namespace.Instance
	A, B, C, D, E echo.Instances

              memory: 256Mi
            requests:
              cpu: 50m
              memory: 128Mi
          env:
            - name: WATCH_NAMESPACE
              value: "istio-test-namespace1,istio-test-namespace2"
            - name: LEADER_ELECTION_NAMESPACE
              value: "operator-test-namespace"
            - name: POD_NAME
              valueFrom:
                fieldRef:

	foo1 := &example.Pod{ObjectMeta: metav1.ObjectMeta{Namespace: "1", Name: "foo"}}
	bar2 := &example.Pod{ObjectMeta: metav1.ObjectMeta{Namespace: "2", Name: "bar"}} // this should not match
	foo3 := &example.Pod{ObjectMeta: metav1.ObjectMeta{Namespace: "3", Name: "foo"}}
	foo4 := &example.Pod{ObjectMeta: metav1.ObjectMeta{Namespace: "4", Name: "foo"}}

              memory: 256Mi
            requests:
              cpu: 50m
              memory: 128Mi
          env:
            - name: WATCH_NAMESPACE
              value: "istio-test-namespace1,istio-test-namespace2"
            - name: LEADER_ELECTION_NAMESPACE
              value: "operator-test-namespace"
            - name: POD_NAME
              valueFrom:
                fieldRef:

			effectiveRules: []rbacv1.PolicyRule{ruleReadPods, ruleReadServices},
		},
		{
			StaticRoles:    staticRoles1,
			user:           &user.DefaultInfo{Name: "foobar"},
			namespace:      "namespace2",
			effectiveRules: nil,
		},
		{
			StaticRoles: staticRoles1,
			// Same as above but without a namespace. Only cluster rules should apply.

  rules:
  - backendRefs:
    - name: httpbin
      port: 86
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: bind-cross-namespace
  namespace: group-namespace2
spec:
  parentRefs:
  - name: gateway
    namespace: istio-system
    sectionName: slctr-labels
  rules:
  - backendRefs:
    - name: httpbin
      port: 87
---

	Namespace ResourceType = iota
	Deployment
	Pod
	Label
	Annotation
	Container
)

// SelectionSpec is a spec for pods that will be Include in the capture
// archive. The format is:
//
//	Namespace1,Namespace2../Deployments/Pods/Label1,Label2.../Annotation1,Annotation2.../ContainerName1,ContainerName2...
//
// Namespace, pod and container names are pattern matching while labels

// If the file is not supplied, it defaults to ""
// The format in a file:
// podNodeSelectorPluginConfig:
//
//	clusterDefaultNodeSelector: <node-selectors-labels>
//	namespace1: <node-selectors-labels>
//	namespace2: <node-selectors-labels>
func readConfig(config io.Reader) *pluginConfig {
	defaultConfig := &pluginConfig{}
	if config == nil || reflect.ValueOf(config).IsNil() {
		return defaultConfig
	}

  // +optional
  optional string kind = 1;

  // Namespace of the referent.
  // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
  // +optional
  optional string namespace = 2;

  // Name of the referent.
  // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
  // +optional
  optional string name = 3;

  // UID of the referent.