plaintextHTTPALPNs = func() []string {
		if features.HTTP10 {
			// If HTTP 1.0 is enabled, we will match it
			return []string{"http/1.0", "http/1.1", "h2c"}
		}
		// Otherwise, matching would just lead to immediate rejection. By not matching, we can let it pass
		// through as raw TCP at least.
		// NOTE: mtlsHTTPALPNs can always include 1.0, for simplicity, as it will only be sent if a client
		return []string{"http/1.1", "h2c"}
	}()

			want:  nil,
		},
		{
			name:  "proxy with IP from the registry, 1 matching WE, but no matching Service",
			proxy: &model.Proxy{Metadata: &model.NodeMetadata{}, IPAddresses: []string{"4.4.4.41"}},
			want:  nil,
		},
		{
			name:  "proxy with IP from the registry, 1 matching WE, and matching Service",
			proxy: &model.Proxy{Metadata: &model.NodeMetadata{}, IPAddresses: []string{"3.3.3.31"}},

message MatchResources {
  // NamespaceSelector decides whether to run the admission control policy on an object based
  // on whether the namespace for that object matches the selector. If the
  // object itself is a namespace, the matching is performed on
  // object.metadata.labels. If the object is another cluster scoped resource,
  // it never skips the policy.
  //
  // For example, to run the webhook on any objects whose namespace is not

							// Test creating a policy with a cluster or namesapce-scoped param
							// and binding with the provided configuration. Test will ensure
							// that the provided configuration is capable of matching
							// params as expected, and not matching params when not expected.
							// Also ensures the NotFound setting works as expected with this particular
							// configuration of ParamRef when all the previously

Method <org.gradle.api.DomainObjectSet.matching(groovy.lang.Closure)> has arguments/return type groovy.lang.Closure that is not Gradle public API or primitive or built-in JDK classes or Kotlin classes in (DomainObjectSet.java:0)

message MatchResources {
  // NamespaceSelector decides whether to run the admission control policy on an object based
  // on whether the namespace for that object matches the selector. If the
  // object itself is a namespace, the matching is performed on
  // object.metadata.labels. If the object is another cluster scoped resource,
  // it never skips the policy.
  //
  // For example, to run the webhook on any objects whose namespace is not

		xdstest.ValidateRoutes(t, routes)

		g.Expect(err).NotTo(HaveOccurred())
		g.Expect(len(routes)).To(Equal(1))
	})

	t.Run("for virtual service with regex matching on URI", func(t *testing.T) {
		g := NewWithT(t)
		cg := core.NewConfigGenTest(t, core.TestOptions{})

		routes, err := route.BuildHTTPRoutesForVirtualService(node(cg), virtualServiceWithRegexMatchingOnURI,

	// There are a maximum of 64 match conditions allowed.
	//
	// If a parameter object is provided, it can be accessed via the `params` handle in the same
	// manner as validation expressions.
	//
	// The exact matching logic is (in order):
	//   1. If ANY matchCondition evaluates to FALSE, the policy is skipped.
	//   2. If ALL matchConditions evaluate to TRUE, the policy is evaluated.

    }

    /**
     * Travels all containing classes of [innerClass] and finds the one matching ClassId with one of [candidates]. Returns the matching
     * ClassId. If it does not have a matching ClassId, it returns null.
     */
    private fun findMostInnerClassMatchingId(innerClass: KtClassOrObject, candidates: Set<ClassId>): ClassId? {

	// There are a maximum of 64 match conditions allowed.
	//
	// If a parameter object is provided, it can be accessed via the `params` handle in the same
	// manner as validation expressions.
	//
	// The exact matching logic is (in order):
	//   1. If ANY matchCondition evaluates to FALSE, the policy is skipped.
	//   2. If ALL matchConditions evaluate to TRUE, the policy is evaluated.