Status:  v1.ConditionTrue,
						Reason:  batch.JobReasonSuccessPolicy,
						Message: "Matched rules at index 0",
					},
					{
						Type:    batch.JobComplete,
						Status:  v1.ConditionTrue,
						Reason:  batch.JobReasonSuccessPolicy,
						Message: "Matched rules at index 0",
					},
				},
			},
		},

  fi
}

function delete-all-firewall-rules() {
  local -a fws
  kube::util::read-array fws < <(gcloud compute firewall-rules list --project "${NETWORK_PROJECT}" --filter="network=${NETWORK}" --format="value(name)")
  if (( "${#fws[@]}" > 0 )); then
    echo "Deleting firewall rules remaining in network ${NETWORK}: ${fws[*]}"
    delete-firewall-rules "${fws[@]}"
  else

		warnings = appendErrors(warnings, workloadSelectorValidation.Warning)

		if in.Action == security_beta.AuthorizationPolicy_CUSTOM {
			if in.Rules == nil {
				errs = appendErrors(errs, fmt.Errorf("CUSTOM action without `rules` is meaningless as it will never be triggered, "+
					"add an empty rule `{}` if you want it be triggered for every request"))
			} else {

function config-ip-firewall {
  echo "Configuring IP firewall rules"

  # Do not consider loopback addresses as martian source or destination while
  # routing. This enables the use of 127/8 for local routing purposes.
  sysctl -w net.ipv4.conf.all.route_localnet=1

  # The GCI image has host firewall which drop most inbound/forwarded packets.
  # We need to add rules to accept all TCP/UDP/ICMP/SCTP packets.

		if err != nil {
			return nil, err
		}
		rows = append(rows, r...)
	}
	return rows, nil
}

func formatHosts(rules []networking.IngressRule) string {
	list := []string{}
	max := 3
	more := false
	for _, rule := range rules {
		if len(list) == max {
			more = true
		}
		if !more && len(rule.Host) != 0 {
			list = append(list, rule.Host)
		}
	}

				"outbound|8080||*.example.org": basicSettings,
				"inbound|10001||":              overrideSettings,
				"inbound|10002||":              overrideSettings,
			},
		},
		"sidecar per-port rules override top-level rules": {
			destrule: &networking.DestinationRule{
				Host: "*.example.org",
			},
			sidecar: &networking.Sidecar{
				InboundConnectionPool: basicSettings,
				Ingress: []*networking.IstioIngressListener{

//
//	//go:build
//
// Constraints may appear in any kind of source file (not just Go), but
// they must appear near the top of the file, preceded
// only by blank lines and other comments. These rules mean that in Go
// files a build constraint must appear before the package clause.
//
// To distinguish build constraints from package documentation,
// a build constraint should be followed by a blank line.
//

	var arns []string
	if rCfg.RoleArn != "" {
		arns = append(arns, rCfg.RoleArn)
	} else {
		for _, rule := range rCfg.Rules {
			arns = append(arns, rule.Destination.String())
		}
	}
	var sameTarget bool
	for _, arnStr := range arns {
		arn, err := madmin.ParseARN(arnStr)
		if err != nil {

			}
			writeErrorResponse(ctx, w, toAPIError(ctx, err), r.URL)
			return
		}
	}
	defer gr.Close()

	objInfo := gr.ObjInfo

	if !proxy.Proxy { // apply lifecycle rules only for local requests
		// Automatically remove the object/version if an expiry lifecycle rule can be applied
		if lc, err := globalLifecycleSys.Get(bucket); err == nil {
			rcfg, err := globalBucketObjectLockSys.Get(bucket)

					MatchingPrecedence:         math.MaxInt32,
					DistinguisherMethod:        &flowcontrol.FlowDistinguisherMethod{Type: flowcontrol.FlowDistinguisherMethodByUserType},
					Rules: []flowcontrol.PolicyRulesWithSubjects{{
						Subjects: []flowcontrol.Subject{{
							Kind:  flowcontrol.SubjectKindGroup,
							Group: &flowcontrol.GroupSubject{Name: "system:authenticated"},
						}},