message SubjectAccessReviewStatus {
  // Allowed is required. True if the action would be allowed, false otherwise.
  optional bool allowed = 1;

  // Denied is optional. True if the action would be denied, otherwise
  // false. If both allowed is false and denied is false, then the
  // authorizer has no opinion on whether to authorize the action. Denied
  // may not be true if Allowed is true.
  // +optional

message SubjectAccessReviewStatus {
  // Allowed is required. True if the action would be allowed, false otherwise.
  optional bool allowed = 1;

  // Denied is optional. True if the action would be denied, otherwise
  // false. If both allowed is false and denied is false, then the
  // authorizer has no opinion on whether to authorize the action. Denied
  // may not be true if Allowed is true.
  // +optional

	if l.FilterChainMatcher == nil {
		return []string{getMatches(fc.GetFilterChainMatch())}
	}
	switch v := l.GetFilterChainMatcher().GetOnNoMatch().GetOnMatch().(type) {
	case *matcher.Matcher_OnMatch_Action:
		if v.Action.GetName() == fc.GetName() {
			return []string{"UNMATCHED"}
		}
	case *matcher.Matcher_OnMatch_Matcher:
		ms, f := recurse(fc.GetName(), v.Matcher)
		if !f {
			return []string{"NONE"}
		}

  //   counter towards the .backoffLimit is incremented.
  // Additional values are considered to be added in the future. Clients should
  // react to an unknown action by skipping the rule.
  optional string action = 1;

  // Represents the requirement on the container exit codes.
  // +optional
  optional PodFailurePolicyOnExitCodesRequirement onExitCodes = 2;

    # Configure whether Operator manages webhook configurations. The current behavior
    # of Istiod is to manage its own webhook configurations.
    # When this option is set as true, Istio Operator, instead of webhooks, manages the
    # webhook configurations. When this option is set as false, webhooks manage their
    # own webhook configurations.
    operatorManageWebhooks: false

	assertFunc(t, wh.Webhooks, defaultWh.Webhooks)
}

func TestGenerateOptions(t *testing.T) {
	// Test generate option 'true', should not modify webhooks
	testGenerateOption(t, true, func(t *testing.T, actual, expected []admitv1.MutatingWebhook) {
		assert.Equal(t, actual, expected)
	})

	// Test generate option 'false', should modify webhooks
	testGenerateOption(t, false, func(t *testing.T, actual, expected []admitv1.MutatingWebhook) {

      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      (except as stated in this section) patent license to make, have made,
      use, offer to sell, sell, import, and otherwise transfer the Work,
      where such license applies only to those patent claims licensable

import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
import "k8s.io/apimachinery/pkg/util/intstr/generated.proto";

// Package-wide variables from generator "generated".
option go_package = "k8s.io/api/apps/v1beta2";

// DEPRECATED - This group version of ControllerRevision is deprecated by apps/v1/ControllerRevision. See the
// release notes for more information.

  // If this field is not specified, it will default based on the existence of ingress or egress rules;
  // policies that contain an egress section are assumed to affect egress, and all policies
  // (whether or not they contain an ingress section) are assumed to affect ingress.
  // If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ].

    # Configure whether Operator manages webhook configurations. The current behavior
    # of Istiod is to manage its own webhook configurations.
    # When this option is set as true, Istio Operator, instead of webhooks, manages the
    # webhook configurations. When this option is set as false, webhooks manage their
    # own webhook configurations.
    operatorManageWebhooks: false