*out = *in
	out.AuthorizedTTL = in.AuthorizedTTL
	out.UnauthorizedTTL = in.UnauthorizedTTL
	out.Timeout = in.Timeout
	in.ConnectionInfo.DeepCopyInto(&out.ConnectionInfo)
	if in.MatchConditions != nil {
		in, out := &in.MatchConditions, &out.MatchConditions
		*out = make([]WebhookMatchCondition, len(*in))
		copy(*out, *in)
	}
	return
}

	"matchConditions":  "MatchConditions is a list of conditions that must be met for a request to be validated. Match conditions filter requests that have already been matched by the rules, namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed.\n\nIf a parameter object is provided, it can be...

	}); err != nil {
		return err
	}
	if err := s.AddGeneratedConversionFunc((*v1alpha1.MatchCondition)(nil), (*admissionregistration.MatchCondition)(nil), func(a, b interface{}, scope conversion.Scope) error {
		return Convert_v1alpha1_MatchCondition_To_admissionregistration_MatchCondition(a.(*v1alpha1.MatchCondition), b.(*admissionregistration.MatchCondition), scope)
	}); err != nil {
		return err
	}

// matching policy-binding-param tuple. The delegate is then called with the
// list of tuples.
//
// Note: MatchConditions expressions are not evaluated here. The dispatcher delegate
// is expected to ignore the result of any policies whose match conditions dont pass.
// This may be possible to refactor so matchconditions are checked here instead.

	*out = *in
	out.AuthorizedTTL = in.AuthorizedTTL
	out.UnauthorizedTTL = in.UnauthorizedTTL
	out.Timeout = in.Timeout
	in.ConnectionInfo.DeepCopyInto(&out.ConnectionInfo)
	if in.MatchConditions != nil {
		in, out := &in.MatchConditions, &out.MatchConditions
		*out = make([]WebhookMatchCondition, len(*in))
		copy(*out, *in)
	}
	return
}

	*out = *in
	out.AuthorizedTTL = in.AuthorizedTTL
	out.UnauthorizedTTL = in.UnauthorizedTTL
	out.Timeout = in.Timeout
	in.ConnectionInfo.DeepCopyInto(&out.ConnectionInfo)
	if in.MatchConditions != nil {
		in, out := &in.MatchConditions, &out.MatchConditions
		*out = make([]WebhookMatchCondition, len(*in))
		copy(*out, *in)
	}
	return
}

	// across the file.

	// owner: @ivelichkovich, @tallclair
	// alpha: v1.27
	// beta: v1.28
	// stable: v1.30
	// kep: https://kep.k8s.io/3716
	//
	// Enables usage of MatchConditions fields to use CEL expressions for matching on admission webhooks
	AdmissionWebhookMatchConditions featuregate.Feature = "AdmissionWebhookMatchConditions"

	// owner: @jefftree @alexzielenski
	// alpha: v1.26

	if err := Convert_v1beta1_WebhookConnectionInfo_To_apiserver_WebhookConnectionInfo(&in.ConnectionInfo, &out.ConnectionInfo, s); err != nil {
		return err
	}
	out.MatchConditions = *(*[]apiserver.WebhookMatchCondition)(unsafe.Pointer(&in.MatchConditions))
	return nil
}

// Convert_v1beta1_WebhookConfiguration_To_apiserver_WebhookConfiguration is an autogenerated conversion function.

				},
			},
		},
		{
			name:               "match condition with one compilation error",
			attr:               aliceAttr,
			expectedCompileErr: "matchConditions[2].expression: Invalid value: \"('group3' in request.group)\": compilation failed: ERROR: <input>:1:21: undefined field 'group'\n | ('group3' in request.group)\n | ....................^",

	"istio.io/istio/pilot/pkg/util/protoconv"
	"istio.io/istio/pkg/config/host"
)

func Test_clusterMatch(t *testing.T) {
	type args struct {
		proxy          *model.Proxy
		cluster        *cluster.Cluster
		matchCondition *networking.EnvoyFilter_EnvoyConfigObjectMatch
		operation      networking.EnvoyFilter_Patch_Operation
		host           host.Name
	}
	tests := []struct {
		name string
		args args
		want bool
	}{
		{