expectMatch:   false,
		},
		{
			name: "no match on namespace",
			in: &api.Service{
				ObjectMeta: metav1.ObjectMeta{
					Name:      "test",
					Namespace: "testns",
				},
				Spec: api.ServiceSpec{ClusterIP: api.ClusterIPNone},
			},
			fieldSelector: fields.ParseSelectorOrDie("metadata.namespace=nomatch"),
			expectMatch:   false,
		},
		{

				run: func(t framework.TestContext, testTopology map[string]map[string]int) {
					echotest.New(t, all).
						WithDefaultFilters(1, 1).
						FromMatch(match.And(match.NotNaked, match.NotHeadless)).
						ToMatch(match.NotHeadless).
						RunToN(3, func(ctx framework.TestContext, from echo.Instance, dsts echo.Services) {
							srcKey := from.Config().ClusterLocalFQDN()
							if testTopology[srcKey] == nil {

					scope = t.ConfigKube()
				}
				return scope.YAML("", cfg).Apply()
			}).
			FromMatch(match.And(c.sourceMatchers...)).
			// TODO mainly testing proxyless features as a client for now
			ToMatch(match.And(append(c.targetMatchers, match.NotProxylessGRPC)...)).
			WithDefaultFilters(1, c.toN).
			ConditionallyTo(c.comboFilters...)

		doTest := func(t framework.TestContext, from echo.Caller, to echo.Services) {

	// To enable this optimization, following cmark-gfm, we declare by fiat
	// that more than maxBackticks backquotes is too many.
	if n > len(b.last) || b.scanned && b.last[n-1] < i+n {
		goto NoMatch
	}

	for end := i + n; end < len(s); {
		if s[end] != '`' {
			end++
			continue
		}
		estart := end
		for end < len(s) && s[end] == '`' {
			end++
		}
		m := end - estart

	policyIgnore := registrationv1.Ignore
	ccfgURL := urlConfigGenerator{url}.ccfgURL

	return []ValidatingTest{
		{
			Name: "no match",
			Webhooks: []registrationv1.ValidatingWebhook{{
				Name:         "nomatch",
				ClientConfig: ccfgSVC("disallow"),
				Rules: []registrationv1.RuleWithOperations{{
					Operations: []registrationv1.OperationType{registrationv1.Create},
				}},

	return echotest.New(t, apps.All.Instances()).
		WithDefaultFilters(1, 1).
		FromMatch(match.And(
			match.Namespace(apps.Ns1.Namespace),
			match.NotNaked,
			match.NotProxylessGRPC)).
		ToMatch(match.ServiceName(apps.External.All.NamespacedName()))

	t framework.TestContext,
	fn func(t framework.TestContext, from echo.Instance, to echo.Target),
) {
	t.Helper()
	echotest.New(t, echos.Instances).
		WithDefaultFilters(1, 1).
		FromMatch(serviceA).
		ToMatch(serviceB).
		Run(fn)
}

func newServiceExport(service string, serviceExportGVR schema.GroupVersionResource) *mcsapi.ServiceExport {
	return &mcsapi.ServiceExport{
		TypeMeta: metav1.TypeMeta{

	//     returned.
	switch {
	case s == "":
		// Match with no position information.
		ok = true
		compiled = true
		matched = true
		return
	case s == "NOMATCH":
		// Match failure.
		ok = true
		compiled = true
		matched = false
		return
	case 'A' <= s[0] && s[0] <= 'Z':
		// All the other error codes are compile errors.
		ok = true
		compiled = false

	input         []lex.Token
	inputPos      int
	pendingLabels []string // Labels to attach to next instruction.
	labels        map[string]*obj.Prog
	toPatch       []Patch
	addr          []obj.Addr
	arch          *arch.Arch
	ctxt          *obj.Link
	firstProg     *obj.Prog
	lastProg      *obj.Prog
	dataAddr      map[string]int64 // Most recent address for DATA for this symbol.