// Rules holds all the PolicyRules for this ClusterRole
	// +optional
	// +listType=atomic
	Rules []PolicyRule `json:"rules" protobuf:"bytes,2,rep,name=rules"`

	// AggregationRule is an optional field that describes how to build the Rules for this ClusterRole.
	// If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be
	// stomped by the controller.

            DefaultMultipleCandidateResult<Object> result = null;

            DisambiguationRule<Object> rules = consumerSchema.disambiguationRules(attribute);
            if (rules.doesSomething()) {
                result = new DefaultMultipleCandidateResult<>(requested, candidates);
                rules.execute(result);
                if (result.hasResult()) {
                    return result.getMatches();
                }

			ObjectMeta: metav1.ObjectMeta{Name: "system:basic-user"},
			Rules:      basicUserRules,
		},
		{
			// a role which provides just enough power read insensitive cluster information
			ObjectMeta: metav1.ObjectMeta{Name: "system:public-info-viewer"},
			Rules: []rbacv1.PolicyRule{
				rbacv1helpers.NewRule("get").URLs(
					"/livez", "/readyz", "/healthz", "/version", "/version/",

cross:
	hack/make-rules/cross.sh
cross-in-a-container: KUBE_OUTPUT_SUBPATH = $(OUT_DIR)/dockerized
cross-in-a-container:
ifeq (,$(wildcard /.dockerenv))
	echo -e "\nThe 'cross-in-a-container' target can only be used from within a docker container.\n"
else
	hack/make-rules/cross.sh
endif
endif

define CMD_HELP_INFO
# Add rules for all directories in cmd/
#
# Example:

	// Rules holds all the PolicyRules for this ClusterRole
	// +optional
	// +listType=atomic
	Rules []PolicyRule `json:"rules" protobuf:"bytes,2,rep,name=rules"`

	// AggregationRule is an optional field that describes how to build the Rules for this ClusterRole.
	// If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be
	// stomped by the controller.

	rules = dedent.Dedent(strings.Trim(`
		*nat
		:KUBE-MISC-TWO - [0:0]
		-X KUBE-MISC-TWO
		COMMIT
		`, "\n"))
	err = fake.Restore(iptables.TableNAT, []byte(rules), iptables.NoFlushTables, iptables.RestoreCounters)
	if err == nil || !strings.Contains(err.Error(), "referenced by existing rules") {
		t.Fatalf("Expected 'referenced by existing rules' error from Restore, got %v", err)
	}

		extended:  g,
	}

	p.rules = append([]*rule{r}, p.rules...)
}

func (p *ruleList) appendLast(g generator, key string, values, notValues []string) {
	if len(values) == 0 && len(notValues) == 0 {
		return
	}
	r := &rule{
		key:       key,
		values:    values,
		notValues: notValues,
		g:         g,
	}

	p.rules = append(p.rules, r)
}

    /**
     * Returns the currently configured version selection rules object.
     *
     * @return the version selection rules
     * @since 2.2
     */
    ComponentSelectionRules getComponentSelection();

    /**
     * The componentSelection block provides rules to filter or prevent certain components from appearing in the resolution result.
     *

					}, {
						Name: iptables.Chain("KUBE-EXTERNAL-SERVICES"),
					}, {
						Name: iptables.Chain("KUBE-FORWARD"),
						Rules: []*Rule{
							mustParseRule(`-A KUBE-FORWARD -m conntrack --ctstate INVALID -j DROP`),
							mustParseRule(`-A KUBE-FORWARD -m comment --comment "kubernetes forwarding rules" -m mark --mark 0x4000/0x4000 -j ACCEPT`),

	allErrs := field.ErrorList{}
	allErrs = append(allErrs, validation.ValidateObjectMeta(&role.ObjectMeta, true, ValidateRBACName, field.NewPath("metadata"))...)

	for i, rule := range role.Rules {
		if err := ValidatePolicyRule(rule, true, field.NewPath("rules").Index(i)); err != nil {
			allErrs = append(allErrs, err...)
		}
	}
	if len(allErrs) != 0 {
		return allErrs
	}
	return nil
}