return r
		}
		return cmp.Compare(a.Name, b.Name)
	})
	fmt.Fprintln(w, "NAMESPACE\tPOLICY NAME\tACTION\tSCOPE")

	for _, pol := range pols {
		fmt.Fprintf(w, "%v\t%v\t%v\t%v\n",
			pol.Namespace, pol.Name, pol.Action, pol.Scope)
	}
	return w.Flush()
}

// PrintPolicyDump prints the relevant services in the config dump to the ConfigWriter stdout

		meshCfg := krt.FetchOne(ctx, MeshConfig.AsCollection())
		pol := convertAuthorizationPolicy(meshCfg.GetRootNamespace(), i)
		if pol == nil {
			return nil
		}
		return &model.WorkloadAuthorization{
			Authorization: pol,
			LabelSelector: model.NewSelector(i.Spec.GetSelector().GetMatchLabels()),
		}
	}, krt.WithName("AuthzDerivedPolicies"))

						Name:      pol[0].Name,
						Namespace: pol[0].Namespace,
					},
					Spec: *((pol[0].Spec).(*auth.AuthorizationPolicy)), //nolint: govet
				})
			case gvk.PeerAuthentication:
				o = convertPeerAuthentication(systemNS, &clientsecurityv1beta1.PeerAuthentication{
					TypeMeta: metav1.TypeMeta{},
					ObjectMeta: metav1.ObjectMeta{
						Name:      pol[0].Name,
						Namespace: pol[0].Namespace,

./mc admin policy create myminio/ deny-non-sse-kms-pol ./docs/iam/policies/deny-non-sse-kms-objects.json
./mc admin policy create myminio/ deny-invalid-sse-kms-pol ./docs/iam/policies/deny-objects-with-invalid-sse-kms-key-id.json

./mc admin policy attach myminio deny-non-sse-kms-pol --user minio123
./mc admin policy attach myminio deny-invalid-sse-kms-pol --user minio123
./mc admin policy attach myminio consoleAdmin --user minio123

	klog.InfoS("Start()")
	return nil
}

func (m *fakeManager) Policy() Policy {
	klog.InfoS("Policy()")
	pol, _ := NewNonePolicy(nil)
	return pol
}

func (m *fakeManager) Allocate(pod *v1.Pod, container *v1.Container) error {
	klog.InfoS("Allocate", "pod", klog.KObj(pod), "containerName", container.Name)
	return nil
}

func convertAuthorizationPolicy(rootns string, obj *securityclient.AuthorizationPolicy) *security.Authorization {
	pol := &obj.Spec

	polTargetRef := model.GetTargetRefs(pol)
	if len(polTargetRef) > 0 {
		// TargetRef is not intended for ztunnel
		return nil
	}

	scope := security.Scope_WORKLOAD_SELECTOR
	if pol.GetSelector() == nil {
		scope = security.Scope_NAMESPACE
		// TODO: TDA
		if rootns == obj.Namespace {

) []*securityclient.PeerAuthentication {
	return krt.Fetch(ctx, PeerAuths, krt.FilterGeneric(func(a any) bool {
		pol := a.(*securityclient.PeerAuthentication)
		if pol.Namespace == meshCfg.GetRootNamespace() && pol.Spec.Selector == nil {
			return true
		}
		if pol.Namespace != ns {
			return false
		}
		sel := pol.Spec.Selector
		if sel == nil {
			return true // No selector matches everything
		}

func makeTmpPolicy(t *testing.T) string {
	pol := auditv1.Policy{
		TypeMeta: metav1.TypeMeta{
			APIVersion: "audit.k8s.io/v1",
		},
		Rules: []auditv1.PolicyRule{
			{
				Level: auditv1.LevelRequestResponse,
			},
		},
	}
	f, err := ioutil.TempFile("", "k8s_audit_policy_test_")
	require.NoError(t, err, "creating temp file")
	require.NoError(t, stdjson.NewEncoder(f).Encode(pol), "writing policy file")

### Walidacja

* Walidacja większości (lub wszystkich?) **typów danych** Pythona, w tym:
    * Obiektów JSON (`dict`).
    * Tablic JSON (`list`) ze zdefiniowanym typem elementów.
    * Pól tekstowych (`str`) z określeniem minimalnej i maksymalnej długości.
    * Liczb (`int`, `float`) z wartościami minimalnymi, maksymalnymi, itp.

* Walidacja bardziej egzotycznych typów danych, takich jak:
    * URL.

		cpuLimit:      currentCPULimit,
		cpuRequest:    currentCPURequest,
	}

	resizePolicy := make(map[v1.ResourceName]v1.ResourceResizeRestartPolicy)
	for _, pol := range container.ResizePolicy {
		resizePolicy[pol.ResourceName] = pol.RestartPolicy
	}
	determineContainerResize := func(rName v1.ResourceName, specValue, statusValue int64) (resize, restart bool) {
		if specValue == statusValue {
			return false, false