public abstract Property<Boolean> getHttp();

    @Option(option = "url", description = "Configures the URL to send the request to.")
    public void setUrl(String url) {
        if (!getHttp().getOrElse(true) && url.startsWith("http://")) {
            throw new IllegalArgumentException("HTTP is not allowed");
        } else {
            this.url = url;
        }

cd ../testinternal2
env GO111MODULE=off
! go build -v .
stderr 'p\.go:3:8: use of internal package .*internal/w not allowed'
env GO111MODULE=''

[compiler:gccgo] skip # gccgo does not have GOROOT
cd ../testinternal
! go build -v .
stderr 'p\.go:3:8: use of internal package net/http/internal not allowed'

-- testinternal/go.mod --
module testinternal

go 1.16
-- testinternal/p.go --
package p

	//               the number of allowed disruptions. Therefore no disruptions are
	//               allowed and the status of the condition will be False.
	// - InsufficientPods: The number of pods are either at or below the number
	//                     required by the PodDisruptionBudget. No disruptions are
	//                     allowed and the status of the condition will be False.

    std::vector<StackFrame> stack_trace;
    std::string uncompilable_reason;
  };

  // Aggregates information about what kinds of ops are allowed.
  struct OperationFilter {  // TODO(lzr): Add AllowEverything() helper.
    // Whether resource variable ops are allowed are allowed in callees.  We do
    // not allow resource variable ops in called functions (either as direct TF

// with pod UID as part of the string.
func PodDesc(podName, podNamespace string, podUID types.UID) string {
	// Use underscore as the delimiter because it is not allowed in pod name
	// (DNS subdomain format), while allowed in the container name format.
	return fmt.Sprintf("%s_%s(%s)", podName, podNamespace, podUID)

			fakeAuthorizer{
				authorizer.DecisionAllow,
				"RBAC: allowed to patch pod",
				nil,
			},
			"allow",
			"RBAC: allowed to patch pod",
		},
		"decision forbid": {
			fakeAuthorizer{
				authorizer.DecisionDeny,
				"RBAC: not allowed to patch pod",
				nil,
			},
			"forbid",
			"RBAC: not allowed to patch pod",
		},
		"error": {
			fakeAuthorizer{

}

// PrepareForUpdate clears fields that are not allowed to be set by end users on update.
func (podDisruptionBudgetStrategy) PrepareForUpdate(ctx context.Context, obj, old runtime.Object) {
	newPodDisruptionBudget := obj.(*policy.PodDisruptionBudget)
	oldPodDisruptionBudget := old.(*policy.PodDisruptionBudget)
	// Update is not allowed to set status
	newPodDisruptionBudget.Status = oldPodDisruptionBudget.Status

	c.state.ReferencedNamespaceKeys = sets.String{"allowed": struct{}{}}

	ns1 := &v1.Namespace{ObjectMeta: metav1.ObjectMeta{
		Name: "ns1",
		Labels: map[string]string{
			"foo": "bar",
		},
	}}
	ns2 := &v1.Namespace{ObjectMeta: metav1.ObjectMeta{
		Name: "ns2",
		Labels: map[string]string{
			"allowed": "true",
		},
	}}
	ns := clienttest.Wrap(t, c.namespaces)

spec:
  selector:
    matchLabels:
      app: "{{ .To.ServiceName }}"
  rules:
  - to:
    - operation:
        paths: [ "/source-ip" ]
    when:
    - key: source.ip
      values: {{ .Allowed.MustWorkloads.Addresses | toJson }}
  - to:
      - operation:
          paths: [ "/source-ip-notValues" ]
    when:
      - key: source.ip
        notValues: {{ .Denied.MustWorkloads.Addresses | toJson }}
---

[!cgo] skip
[short] skip

cp x.go.txt x.go

# Only allow //go:cgo_ldflag .* in cgo-generated code
[compiler:gc] cp x_gc.go.txt x.go
[compiler:gc] ! go build x
[compiler:gc] stderr '//go:cgo_ldflag .* only allowed in cgo-generated code'

# Ignore _* files
rm x.go
! go build .
stderr 'no Go files'
cp cgo_yy.go.txt _cgo_yy.go
! go build .
stderr 'no Go files' #_* files are ignored...