type SuccessPolicyApplyConfiguration struct {
	Rules []SuccessPolicyRuleApplyConfiguration `json:"rules,omitempty"`
}

// SuccessPolicyApplyConfiguration constructs an declarative configuration of the SuccessPolicy type for use with
// apply.
func SuccessPolicy() *SuccessPolicyApplyConfiguration {
	return &SuccessPolicyApplyConfiguration{}
}

// WithRules adds the given value to the Rules field in the declarative configuration

      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:controller:bootstrap-signer
    namespace: kube-public
  rules:
  - apiGroups:
    - ""
    resources:
    - configmaps
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    resourceNames:
    - cluster-info
    resources:

        buildType.componentSources.@creator[0] == 'Rules#buildType(BuildType)'
        buildType.componentSources.componentA.@type[0] == 'CustomSourceSet'
        buildType.componentSources.componentA.@creator[0] == 'Rules#addSources(BuildType) > create(componentA)'

        buildType.testSources.@type[0] == "org.gradle.model.ModelSet<CustomSourceSet>"
        buildType.testSources.@creator[0] == 'Rules#buildType(BuildType)'

        buildFile << '''
class Rules extends RuleSource {
}

model {
    rules(Rules) { }
}
'''

        expect:
        fails()
        failure.assertHasCause("Declaration of model rule rules(Rules) { ... } @ build.gradle line 6, column 5 is invalid.")
        failure.assertHasCause("A model element of type: 'Rules' can not be constructed.")
    }

  // The action to take if the request is matched with the rules.
  // Default is ALLOW if not specified.
  Action action = 4;
  // Set of RBAC policy groups each containing its rules.
  // If at least one of the groups is matched the policy action will
  // take place.
  // Groups are OR-ed.
  repeated Group groups = 5;
}

message Group {
  // Rules are OR-ed (e.g. ANY rule can match)

        - andRules:
            rules:
            - orRules:
                rules:
                - urlPath:
                    path:
                      exact: /httpbin1
        principals:
        - andIds:
            ids:
            - any: true
      istio-ext-authz-ns[foo]-policy[httpbin-2]-rule[0]:
        permissions:
        - andRules:
            rules:
            - orRules:

        - andRules:
            rules:
            - orRules:
                rules:
                - urlPath:
                    path:
                      exact: /httpbin1
        principals:
        - andIds:
            ids:
            - any: true
      istio-ext-authz-ns[foo]-policy[httpbin-2]-rule[0]:
        permissions:
        - andRules:
            rules:
            - orRules:

name: envoy.filters.network.rbac
typedConfig:
  '@type': type.googleapis.com/envoy.extensions.filters.network.rbac.v3.RBAC
  rules:
    policies:
      ns[foo]-policy[httpbin-deny]-rule[3]:
        permissions:
        - andRules:
            rules:
            - orRules:
                rules:
                - destinationPort: 80
        principals:
        - andIds:
            ids:
            - orIds:
                ids:

name: envoy.filters.http.rbac
typedConfig:
  '@type': type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
  rules:
    policies:
      ns[foo]-policy[httpbin-1]-rule[0]:
        permissions:
        - andRules:
            rules:
            - orRules:
                rules:
                - header:
                    name: :authority
                    safeRegexMatch:
                      regex: (?i)example\.com

name: envoy.filters.network.rbac
typedConfig:
  '@type': type.googleapis.com/envoy.extensions.filters.network.rbac.v3.RBAC
  rules:
    policies:
      ns[foo]-policy[httpbin-2]-rule[0]:
        permissions:
        - andRules:
            rules:
            - orRules:
                rules:
                - destinationPort: 9000
        principals:
        - andIds:
            ids:
            - any: true
  shadowRules: