Rules: []admissionregistration.RuleWithOperations{{
				Operations: []admissionregistration.OperationType{},
				Rule: admissionregistration.Rule{
					APIGroups:   []string{"a"},
					APIVersions: []string{"a"},
					Resources:   []string{"a"},
				},
			}, {
				Operations: nil,
				Rule: admissionregistration.Rule{
					APIGroups:   []string{"a"},
					APIVersions: []string{"a"},
					Resources:   []string{"a"},
				},

		add rule ip kube-proxy firewall-check ip daddr . meta l4proto . th dport vmap @firewall-ips
		add rule ip kube-proxy mark-for-masquerade mark set mark or 0x4000
		add rule ip kube-proxy masquerading mark and 0x4000 == 0 return
		add rule ip kube-proxy masquerading mark set mark xor 0x4000
		add rule ip kube-proxy masquerading masquerade fully-random
		add rule ip kube-proxy nat-output jump services

						"operator": "In",
						"values":   []interface{}{},
					},
				},
			},
			schema: genMatchSelectorSchema(`self.matchExpressions.all(rule, (rule.operator != "In" && rule.operator != "NotIn") || ((has(rule.values) && size(rule.values) > 0)))`),
			errors: []string{"failed rule"},
		},
		{name: "matchExpressions - 'values' may not be specified when 'operator' is 'Exists' or 'DoesNotExist'",
			obj: map[string]interface{}{

				"add an empty rule `{}` if you want it be triggered for every request"))
		}

		for i, rule := range in.GetRules() {
			if rule == nil {
				errs = appendErrors(errs, fmt.Errorf("`rule` must not be nil, found at rule %d", i))
				continue
			}
			if rule.From != nil && len(rule.From) == 0 {

					},
				},
				Rules: []*security_beta.Rule{{}},
			},
			valid: false,
		},
		{
			name: "custom-nil-provider",
			in: &security_beta.AuthorizationPolicy{
				Action: security_beta.AuthorizationPolicy_CUSTOM,
				Rules:  []*security_beta.Rule{{}},
			},
			valid: false,
		},
		{
			name: "custom-invalid-rule",
			in: &security_beta.AuthorizationPolicy{

			byteArray, err := config.ToJSON(destRule.GetRule().Spec)
			if err != nil {
				t.Errorf("Could not parse destination rule: %v", err)
			}
			dr := &networking.DestinationRule{}
			err = json.Unmarshal(byteArray, dr)
			if err != nil {
				t.Errorf("Could not unmarshal destination rule: %v", err)
			}
			ca := dr.TrafficPolicy.Tls.CaCertificates
			if ca != tt.expectedCaCertificateName {

				}
				for _, rule := range meta.lifecycleConfig.Rules {
					if !rule.Expiration.IsNull() || !rule.NoncurrentVersionExpiration.IsNull() {
						// copy the non transition details of the rule
						ruleData, err := xml.Marshal(rule.CloneNonTransition())
						if err != nil {
							return info, errSRBackendIssue(err)
						}

   Selection reasons:
      - Forced
      - Selected by rule
      - Selected by rule: RULE 2
      - Selected by rule: SUBSTITUTION 1
      - Selected by rule: SUBSTITUTION 2
      - Selected by rule: SUBSTITUTION 3

org:foo:1.0 -> org:bar:2.0
\\--- conf
"""
    }

    def "shows version and reason when chosen by dependency resolve rule"() {
        given:

macros and functions such as `self.all(...)`. If the Rule is scoped to an array, the elements of the array are accessible via `self[i]` and also by macros and functions. If the Rule is scoped to a scalar, `self` is bound to the scalar value. Examples: - Rule scoped to a map of objects: {\"rule\": \"self.components['Widget'].priority < 10\"} - Rule scoped to a list of integers: {\"rule\": \"self.values.all(value, value >= 0 && value < 100)\"} - Rule scoped to a string value: {\"rule\": \"self.starts...

		},
		{
			// Set DestinationRule override for tcp_keepalive.
			"destination rule",
			DestinationRule,
			&core.TcpKeepalive{KeepaliveTime: &wrappers.UInt32Value{Value: uint32(DestinationRuleTCPKeepaliveSeconds)}},
		},
		{
			// Set DestinationRule override for tcp_keepalive with empty value.
			"destination rule default",
			DestinationRuleForOsDefault,