n.Const = fmt.Sprintf("%#x", i)
			} else if n.Define[0] == '\'' {
				if _, err := parser.ParseExpr(n.Define); err == nil {
					n.Kind = "iconst"
					n.Const = n.Define
				}
			} else if n.Define[0] == '"' {
				if _, err := parser.ParseExpr(n.Define); err == nil {
					n.Kind = "sconst"
					n.Const = n.Define
				}
			}

			if n.IsConst() {
				continue

			return fmt.Errorf("failed to execute command on ingress gateway sidecar: %v", err)
		}
		cd := configdump.Wrapper{}
		err = cd.UnmarshalJSON(byConfigDump)
		if err != nil {
			return fmt.Errorf("can't parse ingress gateway sidecar config_dump: %v", err)
		}

		for _, svc := range matchingServices {
			for _, port := range svc.Spec.Ports {
				// found destination rule and matching subsets

}

func (d *PolicyDoc) update(p policy.Policy) {
	now := UTCNow().Round(time.Millisecond)
	d.UpdateDate = now
	if d.CreateDate.IsZero() {
		d.CreateDate = now
	}
	d.Policy = p
}

// parseJSON parses both the old and the new format for storing policy
// definitions.
//
// The on-disk format of policy definitions has changed (around early 12/2021)
// from policy.Policy to PolicyDoc. To avoid a migration, loading supports

	err = readDirFn(baseDir, func(name string, typ os.FileMode) error {
		if !typ.IsDir() {
			return nil
		}
		// See if directory has a UUID name.
		base := filepath.Base(name)
		_, err := uuid.Parse(base)
		if err == nil {
			foundDirs[base] = struct{}{}
		}
		return nil
	})
	if err != nil {
		return err
	}
	wantDirs, err := xl.getDataDirs()
	if err != nil {
		return err

}

// GetRolePolicy - returns policies associated with a role ARN.
func (sys *IAMSys) GetRolePolicy(arnStr string) (arn.ARN, string, error) {
	roleArn, err := arn.Parse(arnStr)
	if err != nil {
		return arn.ARN{}, "", fmt.Errorf("RoleARN parse err: %v", err)
	}
	rolePolicy, ok := sys.rolesMap[roleArn]
	if !ok {
		return arn.ARN{}, "", fmt.Errorf("RoleARN %s is not defined.", arnStr)
	}