* @throws Exception
     */
    @Test
    public void testSubstringFromLast() throws Exception {
        assertEquals("ab", StringUtil.substringFromLast("abc", "c"));
        assertEquals("abcab", StringUtil.substringFromLast("abcabc", "c"));
        assertEquals("abc", StringUtil.substringFromLast("abc", ""));
        assertEquals("abc", StringUtil.substringFromLast("abc", null));

	// of a character.
	{"[a-c]*", "x", "\u65e5", "x\u65e5x"},
	{"[^\u65e5]", "x", "abc\u65e5def", "xxx\u65e5xxx"},

	// Start and end of a string.
	{"^[a-c]*", "x", "abcdabc", "xdabc"},
	{"[a-c]*$", "x", "abcdabc", "abcdx"},
	{"^[a-c]*$", "x", "abcdabc", "abcdabc"},
	{"^[a-c]*", "x", "abc", "x"},
	{"[a-c]*$", "x", "abc", "x"},
	{"^[a-c]*$", "x", "abc", "x"},
	{"^[a-c]*", "x", "dabce", "xdabce"},

import spock.lang.*

class PgpKeyIdSpec extends Specification  {

    protected key(arg) {
        new PgpKeyId(arg)
    }

    def "conversion is symmetrical"() {
        expect:
        key("ABCDABCD").asHex == "ABCDABCD"
    }

    def "conversion"() {
        expect:
        key(hex).asLong == decimal
        key(decimal).asHex == hex

        where:
        hex        | decimal
        "AAAAAAAA" | 2863311530

						{"/xyz%30..//abc", "/xyz%30..//abc"},
						{"/app/%2E./admin", "/app/%2E./admin"},
						{`/app\admin`, `/app\admin`},
						{`/app/\/\/\admin`, `/app/\/\/\admin`},
						{`/%2Fapp%5cadmin%5Cabc`, `/%2Fapp%5cadmin%5Cabc`},
						{`/%5Capp%2f%5c%2F%2e%2e%2fadmin%5c\abc`, `/%5Capp%2f%5c%2F%2e%2e%2fadmin%5c\abc`},
						{`/app//../admin`, `/app//../admin`},
						{`/app//../../admin`, `/app//../../admin`},
					},
				},

# groups_without_codegen is the list of group we EXPECT to not have the client generated for
# them.  This happens for types that aren't served from the API server
groups_without_codegen=(
	"abac"
	"imagepolicy"
	"admission"
)
client_gen_file="${KUBE_ROOT}/staging/src/k8s.io/code-generator/cmd/client-gen/main.go"

for group_dirname in "${group_dirnames[@]}"; do

	utilfeature "k8s.io/apiserver/pkg/util/feature"
	versionedinformers "k8s.io/client-go/informers"
	resourcev1alpha2informers "k8s.io/client-go/informers/resource/v1alpha2"
	"k8s.io/kubernetes/pkg/auth/authorizer/abac"
	"k8s.io/kubernetes/pkg/auth/nodeidentifier"
	"k8s.io/kubernetes/pkg/features"
	"k8s.io/kubernetes/pkg/kubeapiserver/authorizer/modes"
	"k8s.io/kubernetes/plugin/pkg/auth/authorizer/node"

        step1.matches("ac")
        step1.matches("abac")
        !step1.matches("bc")
        !step1.matches("ab")
        !step1.matches("a")
        !step1.matches("c")

        and:
        def step2 = PatternStepFactory.getStep("a**c", true);
        step2 instanceof HasPrefixAndSuffixPatternStep

        step2.matches("ac")
        step2.matches("abac")
        !step2.matches("bc")
        !step2.matches("ab")

    }

    @Test public void testMultiCharWildcard() {
        RegExpPatternStep step = new RegExpPatternStep("a*c", true);
        assertTrue(step.matches("abc"));
        assertTrue(step.matches("abrac"));
        assertFalse(step.matches("abcd"));
        assertFalse(step.matches("ab"));
        assertFalse(step.matches("a"));

        step = new RegExpPatternStep("*", true);

  local -r src_dir="${KUBE_HOME}/kube-manifests/kubernetes/gci-trusty"

  # Enable ABAC mode unless the user explicitly opts out with ENABLE_LEGACY_ABAC=false
  if [[ "${ENABLE_LEGACY_ABAC:-}" != "false" ]]; then
    echo "Warning: Enabling legacy ABAC policy. All service accounts will have superuser API access. Set ENABLE_LEGACY_ABAC=false to disable this."

	"k8s.io/apimachinery/pkg/util/wait"
	"k8s.io/kubernetes/pkg/kubeapiserver/authorizer/modes"
)

func TestAuthzValidate(t *testing.T) {
	examplePolicyFile := "../../auth/authorizer/abac/example_policy_file.jsonl"

	testCases := []struct {
		name                 string
		modes                []string
		policyFile           string
		webhookConfigFile    string
		webhookRetryBackoff  *wait.Backoff