go get ./baddep
! go build ./baddep
stderr golang.org[/\\]notx[/\\]useinternal
stderr 'use of internal package golang.org/x/.* not allowed'

# Internal packages in the standard library should not leak into modules.
go get ./fromstd
! go build ./fromstd
stderr 'use of internal package internal/testenv not allowed'

# Dependencies should be able to use their own internal modules...
go mod edit -module=golang.org/notx
go get ./throughdep

package allowed

import (
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/transitive/allowed/a2"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/transitive/forbidden/f2"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/transitive/neither/n2"
)

package allowed

import (
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/simple-fwd/allowed/a2"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/simple-fwd/forbidden/f2"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/simple-fwd/neither/n2"
)

			decision: authorizer.DecisionAllow,
			reason:   "allowed",
			err:      nil,
			expectedAttrs: authorizer.AttributesRecord{
				User:            &user.DefaultInfo{Name: "bob"},
				Verb:            "get",
				Path:            "/mypath",
				ResourceRequest: false,
			},
			expectedStatus: authorizationapi.SubjectAccessReviewStatus{
				Allowed:         true,
				Reason:          "allowed",
				EvaluationError: "",
			},
		},

			p.InspectFeatureGates(feature.DefaultFeatureGate)

			err := p.Validate(context.Background(), tc.attributes, nil)
			if err == nil && !tc.allowed {
				t.Errorf("Expected authorization policy to reject ClusterTrustBundle but it was allowed")
			}
			if err != nil && tc.allowed {
				t.Errorf("Expected authorization policy to accept ClusterTrustBundle but it was rejected: %v", err)
			}
		})
	}
}

      from:
        - source:
            namespaces: [ "{{ .Allowed.NamespaceName }}" ]
    - to:
        - operation: # GRPC
            ports: [ "{{ (.To.PortForName `grpc`).WorkloadPort }}" ]
            paths: [ "/proto.EchoTestService/Echo" ]
            methods: [ "POST" ]
      from:
        - source:
            namespaces: [ "{{ .Allowed.NamespaceName }}" ]
    - to:
        - operation: # TCP

package allowed

import (
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/inverse/allowed/a2"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/inverse/forbidden/f2"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/inverse/neither/n2"
)

	"":                "SubjectAccessReviewStatus",
	"allowed":         "Allowed is required. True if the action would be allowed, false otherwise.",
	"denied":          "Denied is optional. True if the action would be denied, otherwise false. If both allowed is false and denied is false, then the authorizer has no opinion on whether to authorize the action. Denied may not be true if Allowed is true.",

}

var map_ImageReviewStatus = map[string]string{
	"":                 "ImageReviewStatus is the result of the review for the pod creation request.",
	"allowed":          "Allowed indicates that all images were allowed to be run.",
	"reason":           "Reason should be empty unless Allowed is false in which case it may contain a short description of what is wrong.  Kubernetes may truncate excessively long errors when displaying to the user.",

      protocol: TCP
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  annotations:
    internal.istio.io/parents: TCPRoute/allowed-my-svc.istio-system
    internal.istio.io/route-semantics: gateway
  creationTimestamp: null
  name: allowed-my-svc-tcp-0-istio-autogenerated-k8s-gateway
  namespace: istio-system
spec:
  gateways:
  - istio-system/gateway-istio-autogenerated-k8s-gateway-my-svc
  hosts: