}

// ResourcePolicyRule is a predicate that matches some resource
// requests, testing the request's verb and the target resource. A
// ResourcePolicyRule matches a resource request if and only if: (a)
// at least one member of verbs matches the request, (b) at least one
// member of apiGroups matches the request, (c) at least one member of
// resources matches the request, and (d) either (d1) the request does

}

// ResourcePolicyRule is a predicate that matches some resource
// requests, testing the request's verb and the target resource. A
// ResourcePolicyRule matches a resource request if and only if: (a)
// at least one member of verbs matches the request, (b) at least one
// member of apiGroups matches the request, (c) at least one member of
// resources matches the request, and (d) either (d1) the request does

  // matches only a single label. You cannot have a wildcard label by itself (e.g. Host == "*").
  // Requests will be matched against the Host field in the following way:
  // 1. If host is precise, the request matches this rule if the http host header is equal to Host.
  // 2. If host is a wildcard, then the request matches this rule if the http host header

  // Required
  optional WebhookClientConfig clientConfig = 2;

  // Rules describes what operations on what resources/subresources the webhook cares about.
  // The webhook cares about an operation if it matches _any_ Rule.
  // However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks
  // from putting the cluster in a state which cannot be recovered from without completely

		if nsMatched && podMatched {
			if nsLabel != "" && podLabel != "" {
				return fmt.Sprintf("Namespace label %s matches, and pod label %s matches", nsLabel, podLabel), true
			} else if nsLabel != "" {
				outMsg := fmt.Sprintf("Namespace label %s matches", nsLabel)
				if strings.Contains(nsLabel, "kubernetes.io/metadata.name") {
					outMsg += " (Automatic injection is enabled in all namespaces)."
				}

  // Required
  optional WebhookClientConfig clientConfig = 2;

  // Rules describes what operations on what resources/subresources the webhook cares about.
  // The webhook cares about an operation if it matches _any_ Rule.
  // However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks
  // from putting the cluster in a state which cannot be recovered from without completely

  // matches only a single label. You cannot have a wildcard label by itself (e.g. Host == "*").
  // Requests will be matched against the Host field in the following way:
  // 1. If Host is precise, the request matches this rule if the http host header is equal to Host.
  // 2. If Host is a wildcard, then the request matches this rule if the http host header

  // set by the controller component of the resource driver whose name
  // matches the DriverName set in the ResourceClaimStatus this
  // ResourceHandle is embedded in. It is set at allocation time and is
  // intended for processing by the kubelet plugin whose name matches
  // the DriverName set in this ResourceHandle.
  //
  // The maximum size of this field is 16KiB. This may get increased in the

                  description: A label selector is a label query over a set of resources.
                    The result of matchLabels and matchExpressions are ANDed. An empty
                    label selector matches all objects. A null label selector matches
                    no objects.
                  properties:
                    matchExpressions:
                      description: matchExpressions is a list of label selector requirements.

)

// ServiceFilter is used to pass filter information into service based config writer print functions
type ServiceFilter struct {
	Namespace string
}

// Verify returns true if the passed workload matches the filter fields
func (wf *ServiceFilter) Verify(svc *ZtunnelService) bool {
	if wf.Namespace != "" {
		if !strings.EqualFold(svc.Namespace, wf.Namespace) {
			return false
		}
	}

	return true
}