"type(self.setNullableStr) != null_type",

				// a field that is set to null is treated the same as an absent field in validation rules
				"!has(self.setToNullNullableStr)",
			},
			errors: map[string]string{
				// the types used in validation rules don't integrate with CEL's Null type, so
				// all attempts to compare values with null are caught by the type checker at compilation time

function config-ip-firewall {
  echo "Configuring IP firewall rules"

  # Do not consider loopback addresses as martian source or destination while
  # routing. This enables the use of 127/8 for local routing purposes.
  sysctl -w net.ipv4.conf.all.route_localnet=1

  # The GCI image has host firewall which drop most inbound/forwarded packets.
  # We need to add rules to accept all TCP/UDP/ICMP/SCTP packets.

Method <org.gradle.testing.jacoco.tasks.rules.JacocoLimit.getCounter()> does not have raw return type assignable to org.gradle.api.provider.Property in (JacocoLimit.java:0)
Method <org.gradle.testing.jacoco.tasks.rules.JacocoLimit.getMaximum()> does not have raw return type assignable to org.gradle.api.provider.Property in (JacocoLimit.java:0)

		if err != nil {
			return nil, err
		}
		rows = append(rows, r...)
	}
	return rows, nil
}

func formatHosts(rules []networking.IngressRule) string {
	list := []string{}
	max := 3
	more := false
	for _, rule := range rules {
		if len(list) == max {
			more = true
		}
		if !more && len(rule.Host) != 0 {
			list = append(list, rule.Host)
		}
	}

	fp.OnEndpointSliceUpdate(eps3update3, eps3update2)
	fp.syncProxyRules()
	// The second change counteracts the first one, so same expected rules as last time
	assertNFTablesTransactionEqual(t, getLine(), expected, nft.Dump())

	// Sync with no new changes, so same expected rules as last time
	fp.syncProxyRules()
	assertNFTablesTransactionEqual(t, getLine(), expected, nft.Dump())
}

				"outbound|8080||*.example.org": basicSettings,
				"inbound|10001||":              overrideSettings,
				"inbound|10002||":              overrideSettings,
			},
		},
		"sidecar per-port rules override top-level rules": {
			destrule: &networking.DestinationRule{
				Host: "*.example.org",
			},
			sidecar: &networking.Sidecar{
				InboundConnectionPool: basicSettings,
				Ingress: []*networking.IstioIngressListener{

  |   what is allowed in the field.
  |
  | o validators: there could be several levels of validation. Simple type validation could
  |   be done with a regex, but we need inter-field validation and rules which could be
  |   dealt with by something like drools.
  |
  | o i18n: would be good to be able to have names/descriptions/specifications
  |   in as many languages as possible. (see MNG-3626)
  |

		}
		return perr
	}

	return nil
}

// disallowVendorVisibility checks that srcDir is allowed to import p.
// The rules are the same as for /internal/ except that a path ending in /vendor
// is not subject to the rules, only subdirectories of vendor.
// This allows people to have packages and commands named vendor,
// for maximal compatibility with existing source trees.

			}`, valid.Unix()),
			wantErr: `oidc: verify token: oidc: expected audience in ["my-client" "random-client"] got ["not-my-client"]`,
		},
		{
			name: "nuanced audience validation using claim validation rules",
			options: Options{
				JWTAuthenticator: apiserver.JWTAuthenticator{
					Issuer: apiserver.Issuer{
						URL:                 "https://auth.example.com",
						Audiences:           []string{"bar", "foo", "baz"},

//
//	//go:build
//
// Constraints may appear in any kind of source file (not just Go), but
// they must appear near the top of the file, preceded
// only by blank lines and other comments. These rules mean that in Go
// files a build constraint must appear before the package clause.
//
// To distinguish build constraints from package documentation,
// a build constraint should be followed by a blank line.
//