# rule[6] `from`: HTTP field, `to`: HTTP + TCP field.
  - from:
    - source:
          namespaces: ["ns-2"]
          requestPrincipals: ["id-1"]
    to:
    - operation:
          ports: ["8080"]
          methods: ["GET"]
  # rule[7] `from`: TCP field, `to`: TCP field.
  - from:
    - source:
        namespaces: ["ns-1"]
    to:
    - operation:
        ports: ["80"]

        then:
        metadata.id == componentId("myorg", "mymodule", "myrev")
        metadata.extraAttributes.size() == 2
        metadata.extraAttributes[new NamespaceId("namespace-b", "a")] == "info 1"
        metadata.extraAttributes[new NamespaceId("namespace-c", "a")] == "info 2"
    }

    def 'parses old gradle module metadata marker'() {
        when:
        def file = temporaryFolder.file("ivy.xml") << """

Zhonghu Xu <******@****.***> 1691421493 +0800

						{
							ObjectMeta: metav1.ObjectMeta{Name: "a", Namespace: "other"},
							Other:      "foo",
						},
						{
							ObjectMeta: metav1.ObjectMeta{Name: "b", Namespace: "other"},
							Other:      "foo",
						},
					},
					item: genericapitesting.Simple{
						ObjectMeta: metav1.ObjectMeta{Name: "c", Namespace: "other", UID: "uid"},
						Other:      "foo",
					},
				},

	}

	existingRoles := namespaceRoles[namespace]
	for _, existingRole := range existingRoles {
		if role.Name == existingRole.Name {
			klog.Fatalf("role %q was already registered in %q", role.Name, namespace)
		}
	}

	role.Namespace = namespace
	addDefaultMetadata(&role)
	existingRoles = append(existingRoles, role)
	namespaceRoles[namespace] = existingRoles
}

	lock sync.Mutex
}

// UserNamespace holds the configuration for the user namespace.
type userNamespace struct {
	// UIDs mappings for the user namespace.
	UIDMappings []idMapping `json:"uidMappings"`
	// GIDs mappings for the user namespace.
	GIDMappings []idMapping `json:"gidMappings"`
}

// Pod user namespace mapping
type idMapping struct {
	// Required.
	HostId uint32 `json:"hostId"`
	// Required.

		return nil
	}
	namespaces := []string{}
	for _, ns := range r.Namespaces {
		if ls.Matches(toNamespaceSet(ns.Name, ns.Labels)) {
			namespaces = append(namespaces, ns.Name)
		}
	}
	// Ensure stable order
	sort.Strings(namespaces)
	return namespaces
}

func nilOrEqual(have *string, expected string) bool {
	return have == nil || *have == expected
}

func humanReadableJoin(ss []string) string {

	if _, err := coreClient.Namespaces().Get(context.TODO(), namespace, metav1.GetOptions{}); apierrors.IsNotFound(err) {
		if _, err = coreClient.Namespaces().Create(context.TODO(), &v1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: namespace}}, metav1.CreateOptions{}); err != nil && !apierrors.IsAlreadyExists(err) {
			klog.Warningf("create non-exist namespace %s failed:%v", namespace, err)
		}
	}

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: system:network-policies
  namespace: kube-system
  labels:
    addonmanager.kubernetes.io/mode: Reconcile
rules:
  - apiGroups: [""]
    resources:
      - pods
      - nodes
      - namespaces
    verbs:
      - get
      - watch
      - list
  # Watch for changes to Kubernetes NetworkPolicies.
  - apiGroups: ["networking.k8s.io"]
    resources:

		out.Spec.User = ""
	}

	// In v0, leaving namespace empty matches all namespaces
	if len(in.Namespace) == 0 {
		out.Spec.Namespace = "*"
	}
	// In v0, leaving resource empty matches all resources
	if len(in.Resource) == 0 {
		out.Spec.Resource = "*"
	}
	// Any rule in v0 should match all API groups
	out.Spec.APIGroup = "*"

	// In v0, leaving namespace and resource blank allows non-resource paths