field.Forbidden(field.NewPath("spec").Child("rules").Index(0).Child("subjects").Index(0).Child("user"), "user is forbidden when subject kind is not 'User'"),
			field.Forbidden(field.NewPath("spec").Child("rules").Index(0).Child("subjects").Index(0).Child("group"), "group is forbidden when subject kind is not 'Group'"),
		},
	}, {

    Predicate::Kind kind = pred->kind();

    if (kind == Predicate::Kind::kAnd || kind == Predicate::Kind::kOr) {
      std::vector<Predicate*> new_operands;
      absl::c_transform(pred->GetOperands(), std::back_inserter(new_operands),
                        [&](Predicate* p) { return MakeNotPredicate(p); });
      return kind == Predicate::Kind::kOr ? MakeAndPredicate(new_operands)

}

// ParamKind is a tuple of Group Kind and Version.
// +structType=atomic
type ParamKind struct {
	// APIVersion is the API group version the resources belong to.
	// In format of "group/version".
	// Required.
	APIVersion string `json:"apiVersion,omitempty" protobuf:"bytes,1,rep,name=apiVersion"`

	// Kind is the API kind the resources belong to.
	// Required.

                "@type": "type.googleapis.com/envoy.extensions.transport_sockets.internal_upstream.v3.InternalUpstreamTransport",
                "passthrough_metadata": [
                  {
                    "kind": {
                      "host": {}
                    },
                    "name": "envoy.filters.listener.original_dst"
                  }
                ],
                "transport_socket": {

		}
		kind := schema.GroupVersionKind{Group: crd.Spec.Group, Version: v.Name, Kind: crd.Status.AcceptedNames.Kind}
		if len(kind.Kind) == 0 {
			utilruntime.HandleError(fmt.Errorf("CustomResourceDefinition %s has unexpected empty status.acceptedNames.kind", crd.Name))
			return nil, fmt.Errorf("the server could not properly serve the kind")
		}

			t.Errorf("#%d: marshal(%#v) = [error] %v, want %v", idx, test.Value, err, test.Err)
		}
		if test.Kind != reflect.Invalid {
			if kind := err.(*UnsupportedTypeError).Type.Kind(); kind != test.Kind {
				t.Errorf("#%d: marshal(%#v) = [error kind] %s, want %s", idx, test.Value, kind, test.Kind)
			}
		}
	}
}

// Do invertibility testing on the various structures that we test

				Push:  push0,
				Start: t0,
				ConfigsUpdated: sets.Set[ConfigKey]{
					{Kind: kind.Kind(1), Namespace: "ns1"}: {},
				},
				Reason: NewReasonStats(ServiceUpdate, ServiceUpdate),
			},
			&PushRequest{
				Full:  false,
				Push:  push1,
				Start: t1,
				ConfigsUpdated: sets.Set[ConfigKey]{
					{Kind: kind.Kind(2), Namespace: "ns2"}: {},
				},
				Reason: NewReasonStats(EndpointUpdate),
			},

				continue
			}
			error_(f.NamePos[n], "could not determine kind of name for C.%s", fixGo(n.Go))
		case notStrLiteral | notType:
			n.Kind = "iconst"
		case notIntConst | notStrLiteral | notType:
			n.Kind = "fconst"
		case notIntConst | notNumConst | notType:
			n.Kind = "sconst"
		case notIntConst | notNumConst | notStrLiteral:
			n.Kind = "type"
		case notIntConst | notNumConst | notStrLiteral | notType:

                  "dataSource": {
                    "apiGroup": "apiGroupValue",
                    "kind": "kindValue",
                    "name": "nameValue"
                  },
                  "dataSourceRef": {
                    "apiGroup": "apiGroupValue",
                    "kind": "kindValue",
                    "name": "nameValue",
                    "namespace": "namespaceValue"

                  "dataSource": {
                    "apiGroup": "apiGroupValue",
                    "kind": "kindValue",
                    "name": "nameValue"
                  },
                  "dataSourceRef": {
                    "apiGroup": "apiGroupValue",
                    "kind": "kindValue",
                    "name": "nameValue",
                    "namespace": "namespaceValue"