typedConfig:
  '@type': type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
  rules:
    action: DENY
    policies:
      istio-ext-authz-ns[foo]-policy[httpbin-1]-rule[0]-deny-due-to-bad-CUSTOM-action:
        permissions:
        - andRules:
            rules:
            - orRules:
                rules:
                - urlPath:
                    path:
                      exact: /httpbin1

  - static_configs:
    - targets: ['localhost:9093']
rule_files:
  - rules.yml
```
Here `rules.yml` is the file which should contain the alerting rules defined.

## Add rules for your deployment
Below is a sample alerting rules configuration for MinIO. Refer https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/ for more instructions on writing alerting rules for Prometheus.

```yaml
groups:
- name: example
  rules:

  - group: ""
    kind: Service
    name: reviews
    port: 9080
  rules:
  - backendRefs:
    - name: reviews-v1
      port: 9080
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: productpage
spec:
  parentRefs:
  - group: ""
    kind: Service
    name: productpage
    port: 9080
  rules:
  - backendRefs:
    - name: productpage-v1
      port: 9080
---

    }

    boolean isClassBasedRulesOnly() {
        return classBasedRulesOnly;
    }

    boolean isEmpty() {
        return rules.isEmpty();
    }

    @Override
    public Iterator<MetadataRuleWrapper> iterator() {
        return rules.iterator();
    }

    Collection<SpecConfigurableRule> getOnlyClassRules() {
        if (!isClassBasedRulesOnly() || isEmpty()) {

				return
			}
		case "Rules":
			var zb0002 uint32
			zb0002, err = dc.ReadArrayHeader()
			if err != nil {
				err = msgp.WrapError(err, "Rules")
				return
			}
			if cap(z.Rules) >= int(zb0002) {
				z.Rules = (z.Rules)[:zb0002]
			} else {
				z.Rules = make([]BatchJobExpireFilter, zb0002)
			}
			for za0001 := range z.Rules {
				err = z.Rules[za0001].DecodeMsg(dc)
				if err != nil {

                  | Rules:
                     ⤷ components { ... } @ build.gradle line 88, column 5
                + myComponent
                      | Type:   	UnmanagedComponent
                      | Creator: 	myComponent(UnmanagedComponent) { ... } @ build.gradle line 89, column 9
                      | Rules:

name: envoy.filters.http.rbac
typedConfig:
  '@type': type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
  rules:
    policies:
      ns[foo]-policy[httpbin]-rule[0]:
        permissions:
        - andRules:
            rules:
            - orRules:
                rules:
                - header:
                    name: :method
                    stringMatch:
                      exact: rule[0]-to[0]-method[0]

        - andRules:
            rules:
            - orRules:
                rules:
                - urlPath:
                    path:
                      exact: /httpbin1
        principals:
        - andIds:
            ids:
            - any: true
      istio-ext-authz-ns[foo]-policy[httpbin-2]-rule[0]:
        permissions:
        - andRules:
            rules:
            - orRules:

		return s.StandardStorage.Create(ctx, obj, createValidation, options)
	}

	role := obj.(*rbac.Role)
	rules := role.Rules
	if err := rbacregistryvalidation.ConfirmNoEscalationInternal(ctx, s.ruleResolver, rules); err != nil {
		return nil, errors.NewForbidden(groupResource, role.Name, err)
	}
	return s.StandardStorage.Create(ctx, obj, createValidation, options)
}

    }

    String reportFor(UnboundRule.Builder... rules) {
        reportFor(rules.toList()*.build())
    }

    String reportFor(List<UnboundRule> rules) {
        def writer = new StringWriter()
        new UnboundRulesReporter(new PrintWriter(writer), "").reportOn(rules)
        normaliseLineSeparators(writer.toString())
    }

    def "creates unbound rules for unfulfilled binders with unbound subject reference"() {