}
		// an empty name list always matches
		if len(namedRule.ResourceNames) == 0 {
			return true, matchResource, matchKind, nil
		}
		// TODO: GetName() can return an empty string if the user is relying on
		// the API server to generate the name... figure out what to do for this edge case
		name := attr.GetName()
		for _, matchedName := range namedRule.ResourceNames {
			if name == matchedName {

            "operator": "operatorValue",
            "values": [
              "valuesValue"
            ]
          }
        ]
      },
      "resourceRules": [
        {
          "resourceNames": [
            "resourceNamesValue"
          ],
          "operations": [
            "operationsValue"
          ],
          "apiGroups": [
            "apiGroupsValue"
          ],

        def packageNames = [ 'allowed.pkg1', 'allowed.pkg2' ]
        def resourceNames = [ 'allowed.resource1', 'allowed.resource2' ]
        def resourcePrefixes = [ 'allowed.resourcePrefix1.', 'allowed.resourcePrefix2.' ]
        return new FilteringClassLoader.Spec(classNames, packageNames, packagePrefixes, resourcePrefixes, resourceNames, disallowedClassNames, disallowedPackagePrefixes)
    }

    def visitableUrlClassloaderSpec() {

        def packageNames = [ 'allowed.pkg1', 'allowed.pkg2' ]
        def resourceNames = [ 'allowed.resource1', 'allowed.resource2' ]
        def resourcePrefixes = [ 'allowed.resourcePrefix1.', 'allowed.resourcePrefix2.' ]
        def spec = new FilteringClassLoader.Spec(classNames, packageNames, packagePrefixes, resourcePrefixes, resourceNames, disallowedClassNames, disallowedPackagePrefixes)

        when:

        def packageNames = [ 'allowed.pkg1', 'allowed.pkg2' ]
        def resourceNames = [ 'allowed.resource1', 'allowed.resource2' ]
        def resourcePrefixes = [ 'allowed.resourcePrefix1.', 'allowed.resourcePrefix2.' ]
        return new FilteringClassLoader.Spec(classNames, packageNames, packagePrefixes, resourcePrefixes, resourceNames, disallowedClassNames, disallowedPackagePrefixes)
    }

    def visitableUrlClassloaderSpec() {

        List<String> packageNames = decodeStrings(decoder);
        List<String> resourceNames = decodeStrings(decoder);
        List<String> resourcePrefixes = decodeStrings(decoder);

        return new FilteringClassLoader.Spec(classNames, packageNames, packagePrefixes, resourcePrefixes, resourceNames, disallowedClassNames, disallowedPackagePrefixes);
    }

    - '*'
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: istio-sidecar-psp
rules:
  - apiGroups:
      - extensions
    resources:
      - podsecuritypolicies
    resourceNames:
      - istio-sidecar
    verbs:
      - use
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: istio-sidecar-psp
roleRef:
  apiGroup: rbac.authorization.k8s.io

      {
        "verbs": [
          "verbsValue"
        ],
        "apiGroups": [
          "apiGroupsValue"
        ],
        "resources": [
          "resourcesValue"
        ],
        "resourceNames": [
          "resourceNamesValue"
        ]
      }
    ],
    "nonResourceRules": [
      {
        "verbs": [
          "verbsValue"
        ],
        "nonResourceURLs": [

  },
  "rules": [
    {
      "verbs": [
        "verbsValue"
      ],
      "apiGroups": [
        "apiGroupsValue"
      ],
      "resources": [
        "resourcesValue"
      ],
      "resourceNames": [
        "resourceNamesValue"
      ],
      "nonResourceURLs": [
        "nonResourceURLsValue"
      ]
    }
  ],
  "aggregationRule": {
    "clusterRoleSelectors": [
      {

    uid: uidValue
  resourceVersion: resourceVersionValue
  selfLink: selfLinkValue
  uid: uidValue
rules:
- apiGroups:
  - apiGroupsValue
  nonResourceURLs:
  - nonResourceURLsValue
  resourceNames:
  - resourceNamesValue
  resources:
  - resourcesValue
  verbs: