// | ResourceVersion | AllowWatchBookmarks | SendInitialEvents     |
		// +=================+=====================+=======================+
		// | Unset           | true/false          | nil/true/false        |
		// +-----------------+---------------------+-----------------------+
		{
			name: "RV=unset, allowWatchBookmarks=true, sendInitialEvents=nil",
			opts: listOptions(true, nil, ""),

        null        | null          | []            | "add to unset value w/ empty convention"          | { it.add("1") }
        ["1"]       | null          | []            | "append to unset value w/ empty convention"       | { it.append("1") }

  //
  // - If `paramKind` is cluster-scoped, this field MUST be unset. Setting this
  // field results in a configuration error.
  //
  // - If `paramKind` is namespace-scoped, the namespace of the object being
  // evaluated for admission will be used when this field is left unset. Take
  // care that if this is left empty the binding must not match any cluster-scoped

	// line breaks. The message must not contain line breaks.
	// If unset, the message is "failed rule: {Rule}".
	// e.g. "must be a URL with the host matching spec.host"
	// If the Expression contains line breaks. Message is required.
	// The message must not contain line breaks.
	// If unset, the message is "failed Expression: {Expression}".
	// +optional

	name string
	v    int
}

type Bitmap []uint32

// set the i-th bit.
func (bm Bitmap) Set(i Sym) {
	n, r := uint(i)/32, uint(i)%32
	bm[n] |= 1 << r
}

// unset the i-th bit.
func (bm Bitmap) Unset(i Sym) {
	n, r := uint(i)/32, uint(i)%32
	bm[n] &^= (1 << r)
}

// whether the i-th bit is set.
func (bm Bitmap) Has(i Sym) bool {
	n, r := uint(i)/32, uint(i)%32

            it.put('k2', '4')
        }

        expect:
        assertValueIs(['k0': '1', 'k1': '2', 'k2': '4'])
        property.explicit

        when:
        property.unset()

        then:
        assertValueIs(['k0': '1'])
        !property.explicit
    }

    def "may configure incrementally based on convention value using insert"() {
        given:

//
// +-----------------+---------------------+-------------------+
// | ResourceVersion | AllowWatchBookmarks | SendInitialEvents |
// +=================+=====================+===================+
// | Unset           | true/false          | true/false        |
// | 0               | true/false          | true/false        |
// | 1               | true/false          | true/false        |

				allErrs.SchemaErrors = append(allErrs.SchemaErrors, field.Invalid(fldPath.Child("items").Child("x-kubernetes-list-type"), is.XListType, "must be atomic as item of a list with x-kubernetes-list-type=set"))
			}
		case "object":
			if is.XMapType == nil || *is.XMapType != "atomic" { // granular is the implicit default behaviour if unset, hence nil and != atomic are wrong

			Namespace: "ns1",
		}))})

	// Set workload policy to be UNSET with a STRICT port-level override
	s.addPolicy(t, selectorPolicyName, testNS, map[string]string{"app": "a"}, gvk.PeerAuthentication, func(c controllers.Object) {
		pol := c.(*clientsecurityv1beta1.PeerAuthentication)
		pol.Spec.Mtls = nil // equivalent to UNSET
		pol.Spec.PortLevelMtls = map[uint32]*auth.PeerAuthentication_MutualTLS{
			9090: {

				}
				return
			}

			if err != nil {
				t.Fatalf("GetList failed: %v", err)
			}
			if len(out.ResourceVersion) == 0 {
				t.Errorf("%s: unset resourceVersion", tt.name)
			}

			if tt.expectedAlternatives == nil {
				expectNoDiff(t, "incorrect list pods", tt.expectedOut, out.Items)
			} else {