authorizerResult: authorizerResult{decision: authorizer.DecisionAllow, reason: "", err: nil},
		},
		defaultResult: authorizerResult{decision: authorizer.DecisionDeny, reason: "", err: nil},
	}
}

type fakeAuthorizer struct {
	match         *authorizerMatch
	defaultResult authorizerResult
}

type authorizerResult struct {
	decision authorizer.Decision
	reason   string
	err      error
}

// encounter an error. We are failing open now to preserve backwards compatible
// behavior.
func (w *WebhookAuthorizer) Authorize(ctx context.Context, attr authorizer.Attributes) (decision authorizer.Decision, reason string, err error) {
	r := &authorizationv1.SubjectAccessReview{}
	if user := attr.GetUser(); user != nil {
		r.Spec = authorizationv1.SubjectAccessReviewSpec{
			User:   user.GetName(),

	"k8s.io/client-go/kubernetes"
	"k8s.io/client-go/kubernetes/fake"
	k8stesting "k8s.io/client-go/testing"

	"istio.io/istio/pkg/revisions"
	"istio.io/istio/pkg/test/util/retry"
)

const testLock = "test-lock"

func createElection(t *testing.T,
	name string, revision string,
	watcher revisions.DefaultWatcher,
	expectLeader bool,
	client kubernetes.Interface, fns ...func(stop <-chan struct{}),
) (*LeaderElection, chan struct{}) {

			Path:      tc.Path,

			ResourceRequest: len(tc.NS) > 0 || len(tc.Resource) > 0,
		}
		decision, _, _ := a.Authorize(context.Background(), attr)
		if tc.ExpectDecision != decision {
			t.Logf("tc: %v -> attr %v", tc, attr)
			t.Errorf("%d: Expected allowed=%v but actually allowed=%v\n\t%v",
				i, tc.ExpectDecision, decision, tc)
		}
	}
}

	ctx       resource.Context
	namespace string
	mu        sync.Mutex
	revisions resource.RevVerMap
}

type meshConfig struct {
	configMap
	meshConfig *meshconfig.MeshConfig
}

type injectConfig struct {
	configMap
	injectConfig *inject.Config
	values       *inject.ValuesConfig
}

func newConfigMap(ctx resource.Context, namespace string, revisions resource.RevVerMap) *configMap {
	return &configMap{
		ctx:       ctx,

        platformType << PlatformType.values()
    }

    void "(4) library developer has issues with org:foo:3.1.1 and forces an override of the platform decision with strictly [#platformType]"() {
        // issue with enforced platform: consumer can not override platform decision via constraint
        //                               (an override via an own forced dependency is possible)

			// Allow all and see if we get an error.
			service.Allow()
			decision, _, err := wh.Authorize(context.Background(), attr)
			if tt.wantAuth {
				if decision != authorizer.DecisionAllow {
					t.Errorf("expected successful authorization")
				}
			} else {
				if decision == authorizer.DecisionAllow {
					t.Errorf("expected failed authorization")
				}
			}
			if tt.wantErr {

	defer logRuntime(time.Now(), "Done getting control plane revisions/versions")

	text := ""
	text += fmt.Sprintf("CLI version:\n%s\n\n", version.Info.LongForm())

	revisions := getIstioRevisions(resources)
	istioVersions, proxyVersions := getIstioVersions(ctx, istioNamespace, revisions)
	text += "The following Istio control plane revisions/versions were found in the cluster:\n"
	for rev, ver := range istioVersions {

		a := RBACAuthorizer{ruleResolver}
		for _, attr := range tt.shouldPass {
			if decision, _, _ := a.Authorize(context.Background(), attr); decision != authorizer.DecisionAllow {
				t.Errorf("case %d: incorrectly restricted %s", i, attr)
			}
		}

		for _, attr := range tt.shouldFail {
			if decision, _, _ := a.Authorize(context.Background(), attr); decision == authorizer.DecisionAllow {
				t.Errorf("case %d: incorrectly passed %s", i, attr)

		}
	}

	// It should not adopt revisions.
	revisions, err := ssh.ListControllerRevisions(set, selector)
	if err != nil {
		t.Fatal(err)
	}
	if got, want := len(revisions), 1; got != want {
		t.Errorf("len(revisions) = %v, want %v", got, want)
	}
	for _, revision := range revisions {
		if len(revision.OwnerReferences) > 0 {