expect   authorizer.Decision
		features featuregate.FeatureGate
	}{
		{
			name:   "allowed configmap",
			attrs:  authorizer.AttributesRecord{User: node0, ResourceRequest: true, Verb: "get", Resource: "configmaps", Name: "configmap0-pod0-node0", Namespace: "ns0"},
			expect: authorizer.DecisionAllow,
		},
		{
			name:   "allowed secret via pod",

package bbb

import (
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/allowed-by-both"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/allowed-by-root"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/allowed-by-sub"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/forbidden-by-both"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/forbidden-by-root"

  optional string namespace = 3;
}

// ImageReviewStatus is the result of the review for the pod creation request.
message ImageReviewStatus {
  // Allowed indicates that all images were allowed to be run.
  optional bool allowed = 1;

  // Reason should be empty unless Allowed is false in which case it
  // may contain a short description of what is wrong.  Kubernetes
  // may truncate excessively long errors when displaying to the user.

	cases := []struct {
		cluster cluster2.ID
		allowed bool
	}{
		{"local", true},
		{"remote", true},
		{"remote2", true},
		{"invalid", false},
	}
	for _, tt := range cases {
		t.Run(string(tt.cluster), func(t *testing.T) {
			_, err := sc.ForCluster(tt.cluster)
			if (err == nil) != tt.allowed {
				t.Fatalf("expected allowed=%v, got err=%v", tt.allowed, err)
			}
		})
	}
}

 *
 * <p>
 * For a given build tree, only a single process is allowed write access to extract archives at a time.
 *
 * Multiple build processes are allowed to extract archives concurrently as long as they use different build trees (in other words, different root directories).
 * <p>
 * Within a process, only one thread is allowed write access to a given expanded directory. This is to avoid concurrent writes

						},
						{
							host:  fmt.Sprintf("jwt-and-%s-%s-only.com", allowed.Config().Service, allowed.Config().Namespace.Name()),
							path:  "/",
							token: jwt.TokenIssuer1,
							allow: allow,
						},
						{
							path:  "/",
							host:  fmt.Sprintf("jwt-and-%s-%s-only.com", allowed.Config().Service, allowed.Config().Namespace.Name()),
							token: jwt.TokenIssuer2,
							allow: false,

		requestedIdentityString string
		trustedAccounts         map[types.NamespacedName]struct{}
		wantErr                 string
	}{
		{
			name:    "empty allowed identities",
			wantErr: "not allowed to impersonate",
		},
		{
			name:                    "allowed identities, but not on node",
			caller:                  ztunnelCaller,
			trustedAccounts:         allowZtunnel,
			requestedIdentityString: podSameNode.Identity(),

@UnsupportedWithConfigurationCache(because = "software model")
class InvalidManagedModelMutationIntegrationTest extends AbstractIntegrationSpec {

    def "mutating managed inputs of a rule is not allowed"() {
        when:
        buildScript '''
            @Managed
            interface Person {
                String getName()
                void setName(String name)
            }

        '''

        then:
        fails 'tasks'

        and:
        failure.assertHasCause("Calling setters of a managed type on itself is not allowed")
    }

    def "calling setters of super class from non-abstract getters is not allowed"() {
        when:
        defineCallsSetterInNonAbstractGetterClass()
        buildFile << '''
            @Managed

        }
        apply plugin: Rules
        """

        expect:
        fails "components"
        failure.assertHasCause "Invalid managed model type SampleBinary: @Variant annotation only allowed for properties of type String and org.gradle.api.Named, but property has type java.lang.Integer (invalid property: variantProp)"
    }

    def "variant annotation on property with primitive type raises error"() {