name: egress
  rules:
  - backendRefs:
    - kind: Hostname
      group: networking.istio.io
      name: google.com
      port: 80
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TLSRoute
metadata:
  name: egress
  namespace: default
spec:
  parentRefs:
  - kind: ServiceEntry
    group: networking.istio.io
    name: egress
  rules:
  - backendRefs:
    - kind: Hostname

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: {{ .To.ServiceName }}-request-headers
spec:
  selector:
    matchLabels:
      app: "{{ .To.ServiceName }}"
  rules:
  - to:
    - operation:
        paths: [ "/request-headers" ]
    when:
    - key: request.headers[x-foo]
      values: [ "foo" ]
  - to:
      - operation:
          paths: [ "/request-headers-notValues" ]
    when:

	for _, r := range c.Rules {
		if r.Raw == rule {
			return true, nil
		}
	}

	parsed, err := ParseRule(rule, false)
	if err != nil {
		return false, err
	}

	if position == iptables.Append {
		c.Rules = append(c.Rules, parsed)
	} else {
		c.Rules = append([]*Rule{parsed}, c.Rules...)
	}
	return false, nil
}

		rules, err := ruleResolver.RulesFor(tc.user, tc.namespace)
		if err != nil {
			t.Errorf("case %d: GetEffectivePolicyRules(context)=%v", i, err)
			continue
		}

		// Sort for deep equals
		sort.Sort(byHash(rules))
		sort.Sort(byHash(tc.effectiveRules))

		if !reflect.DeepEqual(rules, tc.effectiveRules) {
			ruleDiff := cmp.Diff(rules, tc.effectiveRules)

     *
     * @param key the primary key
     * @param rules the rules to be snapshotted
     * @return a snapshot of the inputs
     */
    private HashCode computeExplicitInputsSnapshot(KEY key, ConfigurableRules<DETAILS> rules) {
        List<Object> toBeSnapshotted = Lists.newArrayListWithExpectedSize(2 + 2 * rules.getConfigurableRules().size());
        toBeSnapshotted.add(keyToSnapshottable.transform(key));

 * <p>
 * Mutate rules execute after {@link Defaults} rules, but before {@link Finalize} rules.
 * The first parameter of the rule is the rule subject, which is mutable for the duration of the rule.
 * <p>
 * Please see {@link RuleSource} for more information on method rules.
 */
@Retention(RetentionPolicy.RUNTIME)
@Target(ElementType.METHOD)
@Incubating

			tweakIngress: func(ing *networking.Ingress) {
				ing.Spec.Rules[0].IngressRuleValue.HTTP.Paths[0].PathType = &pathTypeFoo
			},
			expectErrsOnFields: []string{
				"spec.rules[0].http.paths[0].pathType",
			},
		},
		"empty path (prefix)": {
			tweakIngress: func(ing *networking.Ingress) {
				ing.Spec.Rules[0].IngressRuleValue.HTTP.Paths[0].Path = ""
				ing.Spec.Rules[0].IngressRuleValue.HTTP.Paths[0].PathType = &pathTypePrefix

 * <p>
 * Default rules execute first for a given subject, just after the subject has been created but before {@link Model} rules and {@link Mutate} rules.
 * The first parameter of the rule is the rule subject, which is mutable for the duration of the rule.
 * <p>
 * Please see {@link RuleSource} for more information on method rules.
 */
@Retention(RetentionPolicy.RUNTIME)
@Target(ElementType.METHOD)

        when:
        buildScript '''
            class Rules extends RuleSource {
              @Model
              void s(String s) {}
            }

            apply type: Rules
        '''

        then:
        fails "tasks"

        and:
        failure.assertHasCause("Declaration of model rule Rules#s(String) is invalid.")

  hostnames: ["first.domain.example"]
  rules:
  - backendRefs:
    - name: httpbin
      kind: GcsBucket
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: invalid-backendRef-notfound
  namespace: default
spec:
  parentRefs:
  - name: gateway
    namespace: istio-system
  hostnames: ["second.domain.example"]
  rules:
  - backendRefs:
    - name: nonexistent