name: envoy.filters.http.rbac
typedConfig:
  '@type': type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
  rules:
    policies:
      ns[foo]-policy[httpbin]-rule[0]:
        permissions:
        - andRules:
            rules:
            - orRules:
                rules:
                - header:
                    name: :authority
                    stringMatch:
                      exact: rule[0]-to[0]-host[1]

        interface BuildType {
            //Readonly
            FunctionalSourceSet getSources()
        }

        class Rules extends RuleSource {
            @Model
            void buildType(BuildType buildType) { }
        }

        apply plugin: Rules
        """

        expect:
        succeeds "model"
        def buildType = ModelReportOutput.from(output).modelNode.buildType

    annotations:
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:controller:attachdetach-controller
  rules:
  - apiGroups:
    - ""
    resources:
    - persistentvolumeclaims
    - persistentvolumes
    verbs:
    - list
    - watch
  - apiGroups:
    - ""
    resources:
    - nodes
    verbs:

      kubernetes.io/bootstrapping: rbac-defaults
    name: admin
  rules: null
- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    annotations:
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: cluster-admin
  rules:
  - apiGroups:
    - '*'
    resources:
    - '*'
    verbs:

                c.items.add 'bar'
            }
        }

        apply plugin: Rules
        """

        then:
        fails 'tasks'

        and:
        failure.assertHasCause "Attempt to modify a read only view of model element 'container.items' of type '$type<String>' given to rule Rules#tryToMutate(ModelMap<Task>, Container)"

        where:
        type << MANAGED_SCALAR_COLLECTION_TYPES

	// RulesFor returns the list of rules that apply to a given user in a given namespace and error.  If an error is returned, the slice of
	// PolicyRules may not be complete, but it contains all retrievable rules.  This is done because policy rules are purely additive and policy determinations
	// can be made on the basis of those rules that are found.
	RulesFor(user user.Info, namespace string) ([]rbacv1.PolicyRule, error)

import org.gradle.internal.resolve.result.ComponentSelectionContext
import org.gradle.internal.resolve.result.DefaultBuildableModuleComponentMetaDataResolveResult
import org.gradle.internal.rules.ClosureBackedRuleAction
import org.gradle.internal.rules.SpecRuleAction
import org.gradle.util.AttributeTestUtil
import org.gradle.util.SnapshotTestUtil
import org.gradle.util.TestUtil
import spock.lang.Specification

		expectCallKind        schema.GroupVersionKind
		matchError            error
		matchResult           bool
	}{
		{
			name:        "no rules (just write)",
			webhook:     &v1.ValidatingWebhook{NamespaceSelector: &metav1.LabelSelector{}, Rules: []v1.RuleWithOperations{}},

                  | Rules:
                     ⤷ components { ... } @ build.gradle line 88, column 5
                + myComponent
                      | Type:   	UnmanagedComponent
                      | Creator: 	myComponent(UnmanagedComponent) { ... } @ build.gradle line 89, column 9
                      | Rules:

				return
			}
		case "Rules":
			var zb0002 uint32
			zb0002, err = dc.ReadArrayHeader()
			if err != nil {
				err = msgp.WrapError(err, "Rules")
				return
			}
			if cap(z.Rules) >= int(zb0002) {
				z.Rules = (z.Rules)[:zb0002]
			} else {
				z.Rules = make([]BatchJobExpireFilter, zb0002)
			}
			for za0001 := range z.Rules {
				err = z.Rules[za0001].DecodeMsg(dc)
				if err != nil {