type: array
                        selector:
                          description: "Selector is an optional field that contains
                            a selector expression (see Policy for sample syntax).
                            \ Only traffic that originates from (terminates at) endpoints
                            matching the selector will be matched. \n Note that: in

        ComponentSelector selector,
        @Nullable String dependencyConfiguration,
        List<IvyArtifactName> artifactNames,
        List<ExcludeMetadata> excludes,
        boolean force, boolean changing, boolean transitive,
        boolean constraint, boolean endorsing, boolean fromLock,
        @Nullable String reason
    ) {
        this.selector = selector;

		ExpectErr string
	}{
		{
			Name: "v1 to internal with match none selector",
			In: &v1.PodDisruptionBudget{
				Spec: v1.PodDisruptionBudgetSpec{
					Selector: &metav1.LabelSelector{
						MatchExpressions: []metav1.LabelSelectorRequirement{
							{
								Key:      "pdb.kubernetes.io/deprecated-v1beta1-empty-selector-match",
								Operator: metav1.LabelSelectorOpExists,
							},
						},
					},

    public boolean accept(String candidate) {
        return version.isEmpty() || version.equals(candidate);
    }

    public static boolean isExact(String selector) {
        return selector != null && !VersionRangeSelector.ALL_RANGE.matcher(selector).matches() && !selector.endsWith("+") && !selector.startsWith("latest.");
    }

        def selector = Stub(ModuleComponentSelector)

        when:
        def spec = store.locateVcsFor(selector)

        then:
        spec == null
        0 * factory._
    }

    def "does nothing when no rule accepts selector"() {
        def selector = Stub(ModuleComponentSelector)
        def mapping = new DefaultVcsMapping(selector, Stub(VersionControlSpecFactory))

    protocol: HTTP
    allowedRoutes:
      namespaces:
        from: Selector
        selector:
          matchLabels:
            istio.io/test-name-part: group
  - name: slctr-expr-in-yes
    hostname: "*.slctr-expr-in-yes.example"
    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:
        from: Selector
        selector:
          matchExpressions:
          - key: istio.io/test-name-part

metadata:
  name: gateway-02-test-02
  namespace: istio-system
spec:
  selector:
    istio: ingressgateway
    type: internal
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      credentialName: "test-02-wildcard-cert" # no validation error, because this gateway selector is not subset of other gateway selector
    hosts:
    - "02.test-02.com"
---

type ObjectSelectorProvider interface {
	// GetObjectSelector gets the webhook ObjectSelector field.
	GetParsedObjectSelector() (labels.Selector, error)
}

// Matcher decides if a request selected by the ObjectSelector.
type Matcher struct {
}

func matchObject(obj runtime.Object, selector labels.Selector) bool {
	if obj == nil {
		return false
	}
	accessor, err := meta.Accessor(obj)
	if err != nil {

			name:      "non-gateway API workload and a selector",
			selection: regularApp,
			policy: &mockPolicyTargetGetter{
				selector: sampleSelector,
			},
			expected:               true,
			enableSelectorPolicies: true,
		},
		{
			name:      "non-gateway API workload and both a targetRef and a selector",
			selection: regularApp,
			policy: &mockPolicyTargetGetter{
				selector:  sampleSelector,

abstract class AbstractVersionSelector implements VersionSelector {
    private final String selector;

    protected AbstractVersionSelector(String selector) {
        this.selector = selector;
    }

    @Override
    public String getSelector() {
        return selector;
    }

    @Override
    public boolean accept(ComponentMetadata candidate) {