// Special-case bit patterns on first/last bit.
// generic.rules changes ANDs of high-part/low-part masks into a couple of shifts,
// for instance:
//    x & 0xFFFF0000 -> (x >> 16) << 16
//    x & 0x80000000 -> (x >> 31) << 31
//
// In case the mask is just one bit (like second example above), it conflicts
// with the above rules to detect bit-testing / bit-clearing of first/last bit.

// be a power of 2 (because it is a single bit) or 0 (if the original value is 0).
// In all of these rules we use a rightmost bit calculation to determine one operand
// for the addition or subtraction. We then just need to calculate if the other
// operand is a valid power of 2 before we can match the rule.
//
// Notes:
//   - the generic rules have already matched single powers of two so we ignore them here

//
// Note, y is always non-negative.
//
// Note, ISELZ is intentionally not used in lower. Where possible, ISEL is converted to ISELZ in late lower
// after all the ISEL folding rules have been exercised.

((Rsh64U|Lsh64)x64 <t> x y)  => (ISEL [0] (S(R|L)D <t> x y) (MOVDconst [0])        (CMPUconst y [64]))
((Rsh64U|Lsh64)x32 <t> x y)  => (ISEL [0] (S(R|L)D <t> x y) (MOVDconst [0])        (CMPWUconst y [64]))

rules:
- destination: apimachinery
  branches:
  - name: master
    source:
      branch: master
      dirs:
      - staging/src/k8s.io/apimachinery
  - name: release-1.27
    go: 1.21.11
    source:
      branch: release-1.27
      dirs:
      - staging/src/k8s.io/apimachinery
  - name: release-1.28
    go: 1.21.11
    source:
      branch: release-1.28
      dirs:
      - staging/src/k8s.io/apimachinery

Ludi Rehak <******@****.***> 1690680342 -0700

					rules[5],
				},
			},
			opts: ObjectOpts{
				IsLatest: true,
				UserTags: "key1=val1",
				Name:     "obj-1",
				Size:     1*humanize.MiByte - 1,
			},
			hasRules: true,
		},
		{ // PUT version with size based filters
			lc: Lifecycle{
				Rules: []Rule{
					rules[1],
					rules[2],
					rules[3],
					rules[4],
					rules[5],
				},
			},

			field.Required(field.NewPath("spec").Child("rules").Index(0).Child("subjects").Index(0).Child("serviceAccount"), "serviceAccount is required when subject kind is 'ServiceAccount'"),
			field.Forbidden(field.NewPath("spec").Child("rules").Index(0).Child("subjects").Index(0).Child("user"), "user is forbidden when subject kind is not 'User'"),

			tweakIngress: func(ing *networking.Ingress) {
				ing.Spec.Rules[0].IngressRuleValue.HTTP.Paths[0].PathType = &pathTypeFoo
			},
			expectErrsOnFields: []string{
				"spec.rules[0].http.paths[0].pathType",
			},
		},
		"empty path (prefix)": {
			tweakIngress: func(ing *networking.Ingress) {
				ing.Spec.Rules[0].IngressRuleValue.HTTP.Paths[0].Path = ""
				ing.Spec.Rules[0].IngressRuleValue.HTTP.Paths[0].PathType = &pathTypePrefix

			proxier.needFullSync = true
		}
	}()

	if !tryPartialSync {
		// Ensure that our jump rules (eg from PREROUTING to KUBE-SERVICES) exist.
		// We can't do this as part of the iptables-restore because we don't want
		// to specify/replace *all* of the rules in PREROUTING, etc.
		//
		// We need to create these rules when kube-proxy first starts, and we need
		// to recreate them if the utiliptables Monitor detects that iptables has

	{utiliptables.TableFilter, utiliptables.ChainForward, kubeForwardChain, "kubernetes forwarding rules"},
	{utiliptables.TableFilter, utiliptables.ChainInput, kubeNodePortChain, "kubernetes health check rules"},
	{utiliptables.TableFilter, utiliptables.ChainInput, kubeProxyFirewallChain, "kube-proxy firewall rules"},