`)

	nft := knftables.NewFake(knftables.IPv4Family, "kube-proxy")
	err := nft.ParseDump(rules)
	if err != nil {
		t.Fatalf("failed to parse given nftables rules: %v", err)
	}
	// ensure rules were parsed correctly
	assertNFTablesTransactionEqual(t, getLine(), rules, nft.Dump())
	runPacketFlowTests(t, getLine(), nft, testNodeIPs, []packetFlowTest{
		{
			name:     "no match",

        realizeChild("c").other == "changed"
        realizeChild("d").other == "changed"
        specialItemClass.isInstance realizeChild("d")
    }

    def "can define config rules for named item using transformed DSL rule closure"() {
        // DSL rules are represented using DeferredModelAction
        def action = mockDeferredModelAction()

        given:
        action.execute(_, _) >> { MutableModelNode node, ModelActionRole role ->

--

[[sec:component_selection_rules]]
== Using component selection rules

Component selection rules may influence which component instance should be selected when multiple versions are available that match a version selector.
Rules are applied against every available version and allow the version to be explicitly rejected by rule.

	"rules":            "rules is a list of host rules used to configure the Ingress. If unspecified, or no rule matches, all traffic is sent to the default backend.",
}

func (IngressSpec) SwaggerDoc() map[string]string {
	return map_IngressSpec
}

        """
    }

    void withLanguageTransforms() {
        withMainSourceSet()
        withCustomLanguageTransform()
    }

    def "component container is visible to rules as various types"() {
        buildFile << """
class Rules extends RuleSource {
    @Defaults
    void verifyAsContainer(ComponentSpecContainer c) {
        assert c.toString() == "ComponentSpecContainer 'components'"

        ]
    }

    def "dollar method is only detected with no explicit receiver - #code"() {
        when:
        buildScript """
            class MyPlugin {
              static class Rules extends RuleSource {
                @Model
                String foo() {
                  "foo"
                }
              }
            }

            apply type: MyPlugin

  repeated RuleWithOperations rules = 3;

  // FailurePolicy defines how unrecognized errors from the admission endpoint are handled -
  // allowed values are Ignore or Fail. Defaults to Fail.
  // +optional
  optional string failurePolicy = 4;

  // matchPolicy defines how the "rules" list is used to match incoming requests.
  // Allowed values are "Exact" or "Equivalent".
  //

	"incomplete":       "Incomplete is true when the rules returned by this call are incomplete. This is most commonly encountered when an authorizer, such as an external authorizer, doesn't support rules evaluation.",

}

var map_MatchResources = map[string]string{
	"":                     "MatchResources decides whether to run the admission control policy on an object based on whether it meets the match criteria. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)",

spec:
  parentRefs:
  - name: gateway
  hostnames: ["bar.example.com"]
  rules:
  - backendRefs:
    - name: b
      port: 80
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: http-2
spec:
  parentRefs:
  - name: gateway
  hostnames: ["foo.example.com"]
  rules:
  - backendRefs:
    - name: d
      port: 80
`).ApplyOrFail(t)