celMatcher: matcher,
				validationFilter: &fakeCelFilter{
					evaluations: tc.evaluations,
					throwError:  tc.throwError,
				},
				messageFilter: &fakeCelFilter{
					evaluations: tc.messageEvaluations,
					throwError:  tc.throwError,
				},
				auditAnnotationFilter: &fakeCelFilter{
					evaluations: tc.auditEvaluations,
					throwError:  tc.throwError,
				},
			}

type fakeCelFilter struct {
	evaluations []cel.EvaluationResult
	throwError  bool
}

func (f *fakeCelFilter) ForInput(context.Context, *admission.VersionedAttributes, *admissionv1.AdmissionRequest, cel.OptionalVariableBindings, *api.Namespace, int64) ([]cel.EvaluationResult, int64, error) {
	if f.throwError {
		return nil, 0, errors.New("test error")
	}
	return f.evaluations, 0, nil
}

}

func (m *mapper) eval(ctx context.Context, input map[string]interface{}) ([]EvaluationResult, error) {
	evaluations := make([]EvaluationResult, len(m.compilationResults))

	for i, compilationResult := range m.compilationResults {
		var evaluation = &evaluations[i]
		evaluation.ExpressionAccessor = compilationResult.ExpressionAccessor

		evalResult, _, err := compilationResult.Program.ContextEval(ctx, input)

)

type MatchResult struct {
	Matches             bool
	Error               error
	FailedConditionName string
}

// Matcher contains logic for converting Evaluations to bool of matches or does not match
type Matcher interface {
	// Match is used to take cel evaluations and convert into decisions
	Match(ctx context.Context, versionedAttr *admission.VersionedAttributes, versionedParams runtime.Object, authz authorizer.Authorizer) MatchResult

	n := index(t1,t2,t3);
	if u != uans[n] {
		print("utest ", t1,t2,t3,pass,
			" is ", u, " sb ", uans[n], "\n");
	}
}

func
main() {
	var i int;
	var u,c uint;

	/*
	 * test constant evaluations
	 */
	pass = "con";	// constant part

	testi( int(1234) <<    0, 0,0,0);
	testi( int(1234) >>    0, 0,0,1);
	testi( int(1234) <<    5, 0,1,0);
	testi( int(1234) >>    5, 0,1,1);

			}
		})
	}
}

type fakeAuthorizerMetrics struct {
	totalCode string

	latency     float64
	latencyCode string

	evaluations       int
	evaluationsResult string

	duration       float64
	durationResult string

	failOpen       int
	failOpenResult string

	cel.NoopMatcherMetrics
}

	for i, compilationResult := range f.compilationResults {
		var evaluation = &evaluations[i]
		if compilationResult.ExpressionAccessor == nil { // in case of placeholder
			continue
		}
		evaluation.ExpressionAccessor = compilationResult.ExpressionAccessor
		if compilationResult.Error != nil {
			evaluation.Error = &cel.Error{
				Type:   cel.ErrorTypeInvalid,

	evaluations1 := atomic.Int64{}
	evaluations2 := atomic.Int64{}

	compiler.RegisterDefinition(&policy1, func(ctx context.Context, matchedResource schema.GroupVersionResource, versionedAttr *admission.VersionedAttributes, versionedParams runtime.Object, namespace *v1.Namespace, runtimeCELCostBudget int64, authz authorizer.Authorizer) validating.ValidateResult {
		evaluations1.Add(1)

	AuditAnnotations []PolicyAuditAnnotation
}

// Validator is contains logic for converting ValidationEvaluation to PolicyDecisions
type Validator interface {
	// Validate is used to take cel evaluations and convert into decisions
	// runtimeCELCostBudget was added for testing purpose only. Callers should always use const RuntimeCELCostBudget from k8s.io/apiserver/pkg/apis/cel/config.go as input.

	group           singleflight.Group
	liveTTL         time.Duration
	// updatedQuotas holds a cache of quotas that we've updated.  This is used to pull the "really latest" during back to
	// back quota evaluations that touch the same quota doc.  This only works because we can compare etcd resourceVersions
	// for the same resource as integers.  Before this change: 22 updates with 12 conflicts.  after this change: 15 updates with 0 conflicts