// NeverInjectSelector: Refuses the injection on pods whose labels match this selector.
	// It's an array of label selectors, that will be OR'ed, meaning we will iterate
	// over it and stop at the first match
	// Takes precedence over AlwaysInjectSelector.
	NeverInjectSelector []metav1.LabelSelector `json:"neverInjectSelector"`

	// AlwaysInjectSelector: Forces the injection on pods whose labels match this selector.

  // Required.
  optional string expression = 2;
}

// MatchResources decides whether to run the admission control policy on an object based
// on whether it meets the match criteria.
// The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
// +structType=atomic
message MatchResources {
  // NamespaceSelector decides whether to run the admission control policy on an object based

  // Checks whether the model contains an `XlaCallModuleOp` operation which
  // is a wrapper around StableHLO.
  // This option is mutually exclusive to `enable_stablehlo_conversion`, the
  // latter of which takes precedence.
  // TODO(b/290109282): explore removing the enable_hlo_to_tf_conversion flag
  // entirely, such that the added passes are no-ops in the non-shlo case.
  module->walk([&](mlir::TF::XlaCallModuleOp xla_call_module_op) {

        return cached;
    }

    /**
     * Creates and returns a new <code>VersionRange</code> that is a restriction of this
     * version range and the specified version range.
     * <p>
     * Note: Precedence is given to the recommended version from this version range over the
     * recommended version from the specified version range.
     * </p>
     *

	}

	if s.Revision != "" {
		if s.Revisions != nil {
			return fmt.Errorf("cannot use --istio.test.revision and --istio.test.revisions at the same time," +
				" --istio.test.revisions will take precedence and --istio.test.revision will be ignored")
		}
		// use Revision as the sole revision in RevVerMap
		s.Revisions = RevVerMap{
			s.Revision: "",
		}
	} else if s.Revisions != nil {

	).Get()

	SharedMeshConfig = env.Register("SHARED_MESH_CONFIG", "",
		"Additional config map to load for shared MeshConfig settings. The standard mesh config will take precedence.").Get()

	MultiRootMesh = env.Register("ISTIO_MULTIROOT_MESH", false,
		"If enabled, mesh will support certificates signed by more than one trustAnchor for ISTIO_MUTUAL mTLS").Get()

	CertificateKey string

	// SkipPhases is a list of phases to skip during command execution.
	// The list of phases can be obtained with the "kubeadm init --help" command.
	// The flag "--skip-phases" takes precedence over this field.
	SkipPhases []string

	// Patches contains options related to applying patches to components deployed by kubeadm during
	// "kubeadm init".
	Patches *Patches

	cacheDir := getDefaultCacheDir()

	// retrieve a user-provided value for the "cache-dir"
	// override httpCacheDir and discoveryCacheDir if user-value is given.
	// user-provided value has higher precedence than default
	// and KUBECACHEDIR environment variable.
	if f.CacheDir != nil && *f.CacheDir != "" && *f.CacheDir != getDefaultCacheDir() {
		cacheDir = *f.CacheDir
	}

	//
	// The following are semantically equivalent:
	//  h.Xattrs[key] = value
	//  h.PAXRecords["SCHILY.xattr."+key] = value
	//
	// When Writer.WriteHeader is called, the contents of Xattrs will take
	// precedence over those in PAXRecords.
	//
	// Deprecated: Use PAXRecords instead.
	Xattrs map[string]string

	// PAXRecords is a map of PAX extended header records.
	//

		// The version/tag mismatch takes precedence over the +incompatible mismatched.
		vcs:  "git",
		path: "vcs-test.golang.org/git/semver-branch.git",
		rev:  "v2.0.0+incompatible",
		err:  `resolves to version v0.1.0 (v2.0.0 is not a tag)`,
	},
	{
		// Git branch with a semver name, matching go.mod file, and mismatched version.
		// The version/tag mismatch takes precedence over the +incompatible mismatched.
		vcs:  "git",