}

// generatePatterns generates all possible patterns using a representative
// sample of parts.
func generatePatterns() []*pattern {
	var pats []*pattern

	collect := func(s string) {
		// Replace duplicate wildcards with unique ones.
		var b strings.Builder
		wc := 0
		for {
			i := strings.Index(s, "{x}")
			if i < 0 {
				b.WriteString(s)
				break
			}
			b.WriteString(s[:i])
			fmt.Fprintf(&b, "{x%d}", wc)

		{
			host.Names{"b", "a", "aa"},
			host.Names{"aa", "a", "b"},
		},
		{
			host.Names{"foo.com", "bar.com", "foo.bar.com"},
			host.Names{"foo.bar.com", "bar.com", "foo.com"},
		},
		// We sort wildcards last, always
		{
			host.Names{"a", "*", "z"},
			host.Names{"a", "z", "*"},
		},
		{
			host.Names{"foo.com", "bar.com", "*.com"},
			host.Names{"bar.com", "foo.com", "*.com"},
		},
		{

			return nil, fmt.Errorf("bad label/annotation selection %s, must have format key=value", ss)
		}
		if strings.Contains(kv[0], "*") {
			return nil, fmt.Errorf("bad label/annotation selection %s, key cannot have '*' wildcards", ss)
		}
		out[kv[0]] = kv[1]
	}
	return out, nil
}

func (s *SelectionSpec) UnmarshalJSON(b []byte) error {
	ft := []ResourceType{Namespace, Deployment, Pod, Label, Annotation, Container}

By default server certificates need to identify which hostnames they're trusted for. You may add as
many as necessary with `addSubjectAlternativeName()`. This mechanism also supports a very limited
form of wildcards `*.example.com` where the `*` must be first and doesn't match nested subdomains.

By default certificates use fast and secure 256-bit ECDSA keys. For interoperability with very old
clients use `HeldCertificate.Builder.rsa2048()`.

# 'go install pkg@version' should report an error if an argument is not
# a main package.
! go install example.com/cmd/a@v1.0.0 example.com/cmd/err@v1.0.0
stderr '^package example.com/cmd/err is not a main package$'

# Wildcards should match only main packages. This module has a non-main package
# with an error, so we'll know if that gets built.
mkdir tmp
cd tmp
go mod init m
go get example.com/cmd@v1.0.0
! go build example.com/cmd/...

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: wildcard-tls-gateway
spec:
  gatewayClassName: acme-lb
  listeners:
  - name: foo-https
    protocol: HTTPS
    port: 443
    hostname: foo.example.com
    tls:
      certificateRefs:
      - kind: Secret
        group: ""
        name: foo-example-com-cert
  - name: wildcard-https
    protocol: HTTPS
    port: 443
    hostname: "*.example.com"

Ben Leggett <******@****.***> 1710179183 -0400

Ben Leggett <******@****.***> 1710179183 -0400

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: attaches-to-wildcard-example-com-with-hostname-intersection
  namespace: gateway-conformance-infra
spec:
  parentRefs:
    - name: isolation
      namespace: gateway-conformance-infra
      sectionName: wildcard-example-com
  hostnames:
    - "bar.com" # doesn't match wildcard-example-com listener
    - "*.example.com"

//     IPV6_V6ONLY=0, wildcard address listen. The dual stack
//     wildcard address listen may fall back to an IPv6-only,
//     AF_INET6 and IPV6_V6ONLY=1, wildcard address listen.
//     Otherwise we prefer an IPv4-only, AF_INET, wildcard address
//     listen.
//
//   - A listen for a wildcard communication domain, "tcp" or
//     "udp", with an IPv4 wildcard address: same as above.
//