}
							}

							ns := namespace.NewOrFail(t, t, namespace.Config{
								Prefix: "validation",
							})

							applyFiles := t.WriteYAMLOrFail(t, "apply", ym)
							dryRunErr := cluster.ApplyYAMLFilesDryRun(ns.Name(), applyFiles...)

							switch {
							case dryRunErr != nil && valid:
								if denied(dryRunErr) {
									t.Fatalf("got unexpected for valid config: %v", dryRunErr)
								} else {