// MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controller will prefix the keys with
  // admission webhook name (e.g. imagepolicy.example.com/error=image-blacklisted). AuditAnnotations will be provided by
  // the admission webhook to add additional context to the audit log for this request.
  // +optional

limitations under the License.
*/

package validating

import (
	"context"

	"k8s.io/apiserver/pkg/admission"
)

type CELPolicyEvaluator interface {
	admission.InitializationValidator

	Validate(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) error
	HasSynced() bool
	Run(stopCh <-chan struct{})

limitations under the License.
*/

package admission

import (
	"context"
	"testing"

	"k8s.io/apimachinery/pkg/runtime/schema"
	"k8s.io/apiserver/pkg/admission"
	quota "k8s.io/apiserver/pkg/quota/v1"
)

type doNothingAdmission struct{}

func (doNothingAdmission) Admit(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) error {
	return nil
}

	corev1 "k8s.io/api/core/v1"
	"k8s.io/apimachinery/pkg/runtime/schema"
	"k8s.io/apiserver/pkg/admission"
	"k8s.io/client-go/kubernetes"
	listersv1 "k8s.io/client-go/listers/core/v1"

	"k8s.io/apiserver/pkg/admission/plugin/webhook/predicates/namespace"
	"k8s.io/apiserver/pkg/admission/plugin/webhook/predicates/object"
	"k8s.io/apiserver/pkg/admission/plugin/webhook/predicates/rules"
)

type MatchCriteria interface {

	// AuditAnnotations is an unstructured key value map set by remote admission controller (e.g. error=image-blacklisted).
	// MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controller will prefix the keys with
	// admission webhook name (e.g. imagepolicy.example.com/error=image-blacklisted). AuditAnnotations will be provided by
	// the admission webhook to add additional context to the audit log for this request.
	// +optional

  // MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controller will prefix the keys with
  // admission webhook name (e.g. imagepolicy.example.com/error=image-blacklisted). AuditAnnotations will be provided by
  // the admission webhook to add additional context to the audit log for this request.
  // +optional

  // MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controller will prefix the keys with
  // admission webhook name (e.g. imagepolicy.example.com/error=image-blacklisted). AuditAnnotations will be provided by
  // the admission webhook to add additional context to the audit log for this request.
  // +optional

	}

	testCases := []struct {
		desc     string
		want     string
		observer metricsObserver
	}{
		{
			desc: "observe policy admission",
			want: `
			# HELP apiserver_validating_admission_policy_check_duration_seconds [ALPHA] Validation admission latency for individual validation expressions in seconds, labeled by policy and further including binding, state and enforcement action taken.

}

// Included returns a copy of the list of resources that the expression-based admission controllers
// should intercept.
func Included() []schema.GroupResource {
	return slices.Clone(included)
}

// Excluded returns a copy of the list of resources that the expression-based admission controllers
// should ignore.
func Excluded() []schema.GroupResource {
	return slices.Clone(excluded)

const (
	metricsNamespace = "apiserver"
	metricsSubsystem = "validating_admission_policy"
)

var (
	// Metrics provides access to validation admission metrics.
	Metrics = newValidationAdmissionMetrics()
)

// ValidatingAdmissionPolicyMetrics aggregates Prometheus metrics related to validation admission control.
type ValidatingAdmissionPolicyMetrics struct {
	policyCheck      *metrics.CounterVec
	policyDefinition *metrics.CounterVec