PresentMatch: true,
				},
			},
		},
	}

	for _, tc := range testCases {
		t.Run(tc.Name, func(t *testing.T) {
			actual := HeaderMatcher(tc.K, tc.V)
			if !cmp.Equal(tc.Expect, actual, protocmp.Transform()) {
				t.Errorf("expecting %v, but got %v", tc.Expect, actual)
			}
		})
	}
}

func TestHostMatcherWithRegex(t *testing.T) {
	testCases := []struct {

			expectedErr:    "",
		},
	}
	for id, tc := range testCases {
		err := VerifyCertificate(
			tc.privPem, tc.certChainPem, tc.rootCertPem, tc.expectedFields)
		if err != nil {
			if len(tc.expectedErr) == 0 {
				t.Errorf("%s: Unexpected error: %v", id, err)
			} else if !strings.Contains(err.Error(), tc.expectedErr) {
				t.Errorf("%s: Unexpected error: %v VS (expected) %s", id, err, tc.expectedErr)
			}

				Value:  "bar",
				Effect: TaintEffectPreferNoSchedule,
			},
			expectMatch: false,
		},
	}

	for _, tc := range testCases {
		if tc.expectMatch != tc.taint.MatchTaint(tc.taintToMatch) {
			t.Errorf("[%s] expect taint %s match taint %s", tc.description, tc.taint.ToString(), tc.taintToMatch.ToString())
		}
	}

		},
	}

	for k, tc := range testcases {
		msgs := ValidatePathSegmentName(tc.Name, tc.Prefix)
		if len(tc.ExpectedMsg) == 0 && len(msgs) > 0 {
			t.Errorf("%s: expected no message, got %v", k, msgs)
		}
		if len(tc.ExpectedMsg) > 0 && len(msgs) == 0 {
			t.Errorf("%s: expected error message, got none", k)
		}
		if len(tc.ExpectedMsg) > 0 && !strings.Contains(msgs[0], tc.ExpectedMsg) {

			log.Fatalf("expected a panic in output for %s, got: %s", tc.Type, out)
		}
		eolIdx := bytes.IndexByte(out[panicIdx:], '\n') + panicIdx
		if panicIdx == -1 {
			log.Fatalf("expected a newline in output for %s after the panic, got: %s", tc.Type, out)
		}
		out = out[0:eolIdx]
		if string(out) != tc.Expect {
			log.Fatalf("expected '%s' for panic(%s(%s)), got %s", tc.Expect, tc.Type, tc.Input, out)
		}
	}

			}

			attrs := admission.NewAttributesRecord(
				tc.newSvc, // new object
				tc.oldSvc, // old object
				core.Kind("Service").WithVersion("version"),
				tc.newSvc.Namespace,
				tc.newSvc.Name,
				corev1.Resource("services").WithVersion("version"),
				"", // subresource
				op,
				opt,
				false, // dryRun
				nil,   // userInfo
			)

			err := ctrl.Validate(context.TODO(), attrs, nil)

			expected: nil,
		},
	}

	for _, tc := range testCases {
		t.Run(tc.name, func(t *testing.T) {
			kernelVersion, err := getVersion(tc.readFileFunc)

			if tc.err != nil {
				assert.Equal(t, tc.err.Error(), err.Error())
				assert.Nil(t, kernelVersion)
			} else {
				assert.NoError(t, err)
				assert.Equal(t, tc.expected.Major(), kernelVersion.Major())
				assert.Equal(t, tc.expected.Minor(), kernelVersion.Minor())

		}

		if wd.ValidatingWebhookTracker.GetLatency() != tc.MaxDuration {
			t.Errorf("expected validate duration: %q, but got: %q", tc.MaxDuration, wd.ValidatingWebhookTracker.GetLatency())
		}

		if wd.APFQueueWaitTracker.GetLatency() != tc.MaxDuration {
			t.Errorf("expected priority & fairness duration: %q, but got: %q", tc.MaxDuration, wd.APFQueueWaitTracker.GetLatency())
		}

			expectedProto: protocol.HTTP2,
		},
	}

	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			actualProto := ConvertProtocol(tc.port, tc.portName, tc.proto, tc.appProto)
			if actualProto != tc.expectedProto {
				t.Errorf("ConvertProtocol(%d, %s, %s, %v) => %s, want %s",
					tc.port, tc.portName, tc.proto, tc.appProto, actualProto, tc.expectedProto)
			}
		})
	}

		},
		{
			name:    "capture all but 1000 groups",
			exclude: NOwnerGroups(1000), // we don't have to put a limit on the number of groups to exclude
		},
	}
	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			err := ValidateOwnerGroups(tc.include, tc.exclude)
			assert.NoError(t, err)
		})
	}
}

func TestValidateOwnerGroups_Invalid(t *testing.T) {
	cases := []struct {
		name    string
		include string