- apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
    verbs: ["update"]
    # TODO: should be on just */status but wildcard is not supported
    resources: ["*"]

  # Needed because status reporter sets the config map owner reference to the istiod pod
  - apiGroups: [""]
    verbs: ["update"]
    resources: ["pods/finalizers"]
{{- end }}

	WildCardEvent = framework.ClusterEvent{Resource: framework.WildCard, ActionType: framework.All, Label: "WildCardEvent"}
	// UnschedulableTimeout is the event when a pod stays in unschedulable for longer than timeout.
	UnschedulableTimeout = framework.ClusterEvent{Resource: framework.WildCard, ActionType: framework.All, Label: "UnschedulableTimeout"}

	verbose bool
	// selectResources constrains the list of resources to compare to only the ones in this list, ignoring all others.
	// The format of each list item is :: and the items are comma separated. The * character represents wildcard selection.
	// e.g.
	// Deployment:istio-system:* - compare all deployments in istio-system namespace
	// Service:*:istio-pilot - compare Services called "istio-pilot" in all namespaces.
	selectResources string

	return newOption("localhost", value)
}

func AdditionalLocalhost(value LocalhostValue) Instance {
	return newOption("additional_localhost", value)
}

func Wildcard(value WildcardValue) Instance {
	return newOption("wildcard", value)
}

func AdditionalWildCard(value WildcardValue) Instance {
	return newOption("additional_wildcard", value)
}

func DualStack(value bool) Instance {

            }]
          }]
        }
      }
    ],
    "listeners":[
      {
        "address": {
           "socket_address": {
             "protocol": "TCP",
             "address": "{{ .wildcard }}",
             "port_value": {{ .envoy_status_port }}
           }
        },
        "filter_chains": [
          {
            "filters": [
              {

	})

	// A pattern ending in a single wildcard should not match a trailing slash URL.
	pat2 := "/a/b/{w}"
	test(buildTree(pat2), []testCase{
		{"GET", "", "/a/b", "", nil},
		{"GET", "", "/a/b/", "", nil},
		{"GET", "", "/a/b/c", pat2, []string{"c"}},
		{"GET", "", "/a/b/c/d", "", nil},
	})

	// A pattern ending in a multi wildcard should match both URLs.
	pat3 := "/a/b/{w...}"

            ConstantReference.NOT_NULL -> KaContractReturnsNotNullEffectDeclaration(analysisContext.token)
            ConstantReference.WILDCARD -> KaContractReturnsSuccessfullyEffectDeclaration(analysisContext.token)
            is BooleanConstantReference -> KaContractReturnsSpecificValueEffectDeclaration(
                KaContractConstantValue(

		&cfg.InboundInterceptionMode)

	flag.BindEnv(fs, constants.InboundPorts, "b",
		"Comma separated list of inbound ports for which traffic is to be redirected to Envoy (optional). "+
			"The wildcard character \"*\" can be used to configure redirection for all ports. An empty list will disable.",
		&cfg.InboundPortsInclude)

	flag.BindEnv(fs, constants.LocalExcludePorts, "d",

	)

	j := JSONPathElement{}
	cases := []string{
		// Key
		"['name']", ".name", `."name"`,

		// Index
		"[2]", "[0]", "[100]",

		// Object wildcard
		".*",

		// array wildcard
		"[*]",
	}
	for i, tc := range cases {
		err := p.ParseString(tc, &j)
		if err != nil {
			t.Fatalf("%d: %v", i, err)
		}
		// repr.Println(j, repr.Indent("  "), repr.OmitEmpty(true))
	}

            ConeContractConstantValues.NOT_NULL -> KaContractReturnsNotNullEffectDeclaration(builder.token)
            ConeContractConstantValues.WILDCARD -> KaContractReturnsSuccessfullyEffectDeclaration(builder.token)
            is KtBooleanConstantReference -> KaContractReturnsSpecificValueEffectDeclaration(
                KaContractConstantValue(