reader := bytes.NewReader(procCgroupData.Bytes())
	var cgroups []Cgroup
	scanner := bufio.NewScanner(reader)

	for scanner.Scan() {
		token := scanner.Text()
		substrings := strings.SplitN(token, ":", 3)
		if len(substrings) < 3 {
			return nil, fmt.Errorf("cgroup entry contains %v colons, but expected at least 2 colons: %q", len(substrings), token)
		}
		cgroups = append(cgroups, Cgroup{

groups:
- rules:
  - matches:
    - destinationPorts:
      - 80
  - matches:
    - namespaces:
      - exact: only-l4-ns
      principals:
      - exact: only-l4-principals
- rules:
  - matches:
    - namespaces:
      - exact: when-l4-ns
  - matches:
    - sourceIps:
      - address: CgoKCg==
        length: 32
name: groups

action: DENY
groups:
- rules:
  - matches:
    - destinationPorts:
      - 80
  - matches:
    - namespaces:
      - exact: from-mix-ns
      principals:
      - exact: from-mix-principal
- rules:
  - matches:
    - destinationPorts:
      - 80
  - matches:
    - namespaces:
      - exact: to-mix-ns
      principals:
      - exact: to-mix-principal
- rules:
  - matches:
    - destinationPorts:
      - 80

		p := "/sys/fs/cgroup/memory/memory.memsw.limit_in_bytes"
		if isCgroup2UnifiedMode() {
			// memory.swap.max does not exist in the cgroup root, so we check /sys/fs/cgroup/<SELF>/memory.swap.max
			_, unified, err := cgroups.ParseCgroupFileUnified("/proc/self/cgroup")
			if err != nil {
				klog.V(5).ErrorS(fmt.Errorf("failed to parse /proc/self/cgroup: %w", err), warn)
				return
			}

lei-tang <******@****.***> 1537395504 -0700

        d.module == 'aModule'
        !d.group
    }

    def "with group and module"() {
        when:
        ExcludeRule d = parser.parseNotation([group: 'aGroup', module: 'aModule']);
        then:
        d != null;
        d instanceof DefaultExcludeRule
        d.group == 'aGroup'
        d.module == 'aModule'
    }

    def "with no group and no module InvalidUserDataException is thrown"() {

Douglas Reid <******@****.***> 1633375461 -0700

Faseela K <******@****.***> 1651883509 +0200

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: groups-deny
spec:
  action: DENY
  rules:
  # Has mix of L4 and L7 in from
  - from:
    - source:
        principals: ["from-mix-principal"]
        requestPrincipals: ["from-mix-requestPrincipals"]
        namespaces: ["from-mix-ns"]
    to:
    - operation:
        ports: ["80"]
  # Has mix of L4 and L7 in to
  - from:
    - source:

Ben Leggett <******@****.***> 1710179183 -0400