repeated RuleWithOperations rules = 3;

  // FailurePolicy defines how unrecognized errors from the admission endpoint are handled -
  // allowed values are Ignore or Fail. Defaults to Fail.
  // +optional
  optional string failurePolicy = 4;

  // matchPolicy defines how the "rules" list is used to match incoming requests.
  // Allowed values are "Exact" or "Equivalent".
  //

message FlowDistinguisherMethod {
  // `type` is the type of flow distinguisher method
  // The supported types are "ByUser" and "ByNamespace".
  // Required.
  optional string type = 1;
}

// FlowSchema defines the schema of a group of flows. Note that a flow is made up of a set of inbound API requests with
// similar attributes and is identified by a pair of strings: the name of the FlowSchema and a "flow distinguisher".
message FlowSchema {

message FlowDistinguisherMethod {
  // `type` is the type of flow distinguisher method
  // The supported types are "ByUser" and "ByNamespace".
  // Required.
  optional string type = 1;
}

// FlowSchema defines the schema of a group of flows. Note that a flow is made up of a set of inbound API requests with
// similar attributes and is identified by a pair of strings: the name of the FlowSchema and a "flow distinguisher".
message FlowSchema {

  repeated k8s.io.api.admissionregistration.v1.RuleWithOperations rules = 3;

  // FailurePolicy defines how unrecognized errors from the admission endpoint are handled -
  // allowed values are Ignore or Fail. Defaults to Ignore.
  // +optional
  optional string failurePolicy = 4;

  // matchPolicy defines how the "rules" list is used to match incoming requests.
  // Allowed values are "Exact" or "Equivalent".
  //

  // via a command line parameter of the driver.
  //
  // This field is immutable.
  //
  // +optional
  optional bool podInfoOnMount = 2;

  // volumeLifecycleModes defines what kind of volumes this CSI volume driver supports.
  // The default if the list is empty is "Persistent", which is the usage defined by the
  // CSI specification and implemented in Kubernetes via the usual PV/PVC mechanism.

  // PodSchedulingSpec.PotentialNodes. This may get increased in the
  // future, but not reduced.
  //
  // +listType=set
  // +optional
  repeated string unsuitableNodes = 2;
}

// ResourceClaimSpec defines how a resource is to be allocated.
message ResourceClaimSpec {
  // ResourceClassName references the driver and additional parameters
  // via the name of a ResourceClass that was created as part of the

  //   or treat it identically to Prefix or Exact path types.
  // Implementations are required to support all path types.
  // Defaults to ImplementationSpecific.
  optional string pathType = 3;

  // backend defines the referenced service endpoint to which the traffic
  // will be forwarded to.
  optional IngressBackend backend = 2;
}

// HTTPIngressRuleValue is a list of http selectors pointing to backends.

  //   or treat it identically to Prefix or Exact path types.
  // Implementations are required to support all path types.
  optional string pathType = 3;

  // backend defines the referenced service endpoint to which the traffic
  // will be forwarded to.
  optional IngressBackend backend = 2;
}

// HTTPIngressRuleValue is a list of http selectors pointing to backends.

// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

// Defines the redirect object and operations.
package plugin

import (
	"fmt"
	"net/netip"
	"strconv"
	"strings"

	"istio.io/api/annotation"
	"istio.io/istio/pkg/log"

  // Status is filled in by the server and indicates the set of actions a user can perform.
  // +optional
  optional SubjectRulesReviewStatus status = 3;
}

// SelfSubjectRulesReviewSpec defines the specification for SelfSubjectRulesReview.
message SelfSubjectRulesReviewSpec {
  // Namespace to evaluate rules for. Required.
  optional string namespace = 1;
}