rules:
- destination: apimachinery
  branches:
  - name: master
    source:
      branch: master
      dirs:
      - staging/src/k8s.io/apimachinery
  - name: release-1.27
    go: 1.21.11
    source:
      branch: release-1.27
      dirs:
      - staging/src/k8s.io/apimachinery
  - name: release-1.28
    go: 1.21.11
    source:
      branch: release-1.28
      dirs:
      - staging/src/k8s.io/apimachinery

	proxier.mu.Lock()
	defer proxier.mu.Unlock()

	// don't sync rules till we've received services and endpoints
	if !proxier.isInitialized() {
		proxier.logger.V(2).Info("Not syncing nftables until Services and Endpoints have been received from master")
		return
	}

	//
	// Below this point we will not return until we try to write the nftables rules.
	//

	// Keep track of how long syncs take.
	start := time.Now()

			}{
				{
					name:  "allow",
					check: check.OK(),
					spec: `
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/{{.Namespace}}/sa/{{.Source}}", "cluster.local/ns/{{.Namespace}}/sa/{{.WaypointName}}"]
`,
				},
				{
					name:  "not allow",
					check: CheckDeny,
					spec: `
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/something/sa/else"]

		})
	}

	type conversionResult struct {
		error  *ConfigError
		routes []*istio.HTTPRoute
	}
	convertRules := func(mesh bool) conversionResult {
		res := conversionResult{}
		for n, r := range route.Rules {
			// split the rule to make sure each rule has up to one match
			matches := slices.Reference(r.Matches)
			if len(matches) == 0 {
				matches = append(matches, nil)
			}
			for _, m := range matches {

{{- range $val := .GwMatches }}
  - group: ""
    kind: Service
    name: "{{$val.Name}}"
    namespace: "{{$val.Namespace}}"
{{ with $.PortMatch }}
    port: {{.}}
{{ end }}
{{ end }}
  rules:
  - backendRefs:
    - kind: Hostname
      group: networking.istio.io
      name: {{.Dest}}
      port: {{.Port | default 80}}
`, args)
	case "virtualservice":

			return objInfo, err
		}
		replcfg, err = getReplicationConfig(ctx, bucket)
		if err != nil {
			return objInfo, err
		}
	}

	// expiration attempted on a bucket with no lifecycle
	// rules shall be rejected.
	if lc == nil && opts.Expiration.Expire {
		if opts.VersionID != "" {
			return objInfo, VersionNotFound{
				Bucket:    bucket,
				Object:    object,
				VersionID: opts.VersionID,

	},
	{
		Meta: config.Meta{Name: uuid.NewString(), Namespace: "istio-system", GroupVersionKind: gvk.AuthorizationPolicy},
		Spec: &security.AuthorizationPolicy{
			Selector:     nil,
			TargetRef:    nil,
			Rules:        nil,
			Action:       security.AuthorizationPolicy_CUSTOM,
			ActionDetail: &security.AuthorizationPolicy_Provider{Provider: &security.AuthorizationPolicy_ExtensionProvider{Name: "extauthz"}},
		},
	},
	{