},
			want: `
			# HELP authorization_attempts_total [ALPHA] Counter of authorization attempts broken down by result. It can be either 'allowed', 'denied', 'no-opinion' or 'error'.
			# TYPE authorization_attempts_total counter
			authorization_attempts_total{result="no-opinion"} 1
				`,
		},
	}

	// Since prometheus' gatherer is global, other tests may have updated metrics already, so

        @Override
        void execute(CompatibilityCheckDetails<String> stringCompatibilityCheckDetails) {
            count++
        }
    }

    def "treats equal values as compatible when no rule expresses an opinion"() {
        given:
        def attribute = Attribute.of(String)
        schema.attribute(attribute).compatibilityRules.add(DoNothingRule)

        expect:

| 1.4
| Any version between `1.0` and `2.0` (exclusive) except for `1.4`, `1.5` if nobody else cares. +
Overwrites versions from transitive dependencies. +
🔒

| No opinion, works with `1.5`.
|
|
| 1.5
|
| `1.5` if no other opinion, any otherwise.

| No opinion, prefer latest release.
|
|
| `latest.release`
|
| The latest release at build time. +
🔒

| On the edge, latest release, no downgrade.
|

 * the metric stability policy.
 */
const (
	successLabel = "success"
	failureLabel = "failure"
	errorLabel   = "error"

	allowedLabel   = "allowed"
	deniedLabel    = "denied"
	noOpinionLabel = "no-opinion"
)

var (
	authenticatedUserCounter = metrics.NewCounterVec(
		&metrics.CounterOpts{
			Name:           "authenticated_user_requests",
			Help:           "Counter of authenticated requests broken out by username.",

            return StackTraceRelevance.USER_CODE;
        }
    };

    /**
     * Returns relevance for the given frame, or null if the classifier does not have an opinion.
     */
    @Nullable
    StackTraceRelevance classify(StackTraceElement frame);

		`
		if err := testutil.GatherAndCompare(legacyregistry.DefaultGatherer, strings.NewReader(expectedValue), metrics...); err != nil {
			t.Fatal(err)
		}
		authorizationDecisionsTotal.Reset()
	}

	// no-opinion emits no metric
	{
		dummyAuthorizer.decision = authorizer.DecisionNoOpinion
		_, _, _ = a.Authorize(context.Background(), nil)
		_, _, _ = a.Authorize(context.Background(), nil)
		expectedValue := prefix + `
		`

		}

		// load/validate kube-apiserver authz config with no opinion about required modes
		_, err := authorizer.LoadAndValidateFile(o.AuthorizationConfigurationFile, nil)
		if err != nil {
			return append(allErrors, err)
		}

		return allErrors
	}

	DecisionDeny Decision = iota
	// DecisionAllow means that an authorizer decided to allow the action.
	DecisionAllow
	// DecisionNoOpinion means that an authorizer has no opinion on whether
	// to allow or deny an action.
	DecisionNoOpinion

	}

	if len(obj.ClientConnection.ContentType) == 0 {
		obj.ClientConnection.ContentType = "application/vnd.kubernetes.protobuf"
	}
	// Scheduler has an opinion about QPS/Burst, setting specific defaults for itself, instead of generic settings.
	if obj.ClientConnection.QPS == 0.0 {
		obj.ClientConnection.QPS = 50.0
	}
	if obj.ClientConnection.Burst == 0 {

// for cases where the options (particularly the CAs) can change.  If the bool is false, then the returned VerifyOptions
// are ignored and the authenticator will express "no opinion".  This allows a clear signal for cases where a CertPool
// is eventually expected, but not currently present.
type VerifyOptionFunc func() (x509.VerifyOptions, bool)