//   request resource.
  // Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
  //
  // Required.
  optional string expression = 2;
}

// MutatingWebhook describes an admission webhook and the resources and operations it applies to.
message MutatingWebhook {
  // The name of the admission webhook.

			// the policy engine matches all Deny statements first, without regard to Resources (for KMS).
			// This is for backwards compatibility where historically KMS statements ignored Resources.
			policy: `{
						"Effect": "Allow",
						"Action": ["kms:ListKeys"]
					},{
						"Effect": "Deny",
						"Action": ["kms:ListKeys"],
						"Resource": ["arn:minio:kms:::default-test-key"]
					}`,

				ResourceType: "role",
				ResourceID:   "my-role",
			},
			wantErr: false,
		},
		{
			name: "valid resource ID must succeed",
			args: args{
				resourceID:   "-my-role",
				serverRegion: "us-east-1",
			},
			want: ARN{
				Partition:    "minio",
				Service:      "iam",
				Region:       "us-east-1",
				ResourceType: "role",
				ResourceID:   "-my-role",
			},
			wantErr: false,
		},

  // Default resource requirement limit value by resource name if resource limit is omitted.
  // +optional
  map<string, k8s.io.apimachinery.pkg.api.resource.Quantity> default = 4;

  // DefaultRequest is the default resource requirement request value by resource name if resource request is omitted.
  // +optional
  map<string, k8s.io.apimachinery.pkg.api.resource.Quantity> defaultRequest = 5;

  </dependencies>
  <build>
    <resources>
      <resource>
        <directory>..</directory>
        <includes>
          <include>LICENSE</include> <!-- copied from the parent pom because I couldn't figure out a way to make combine.children="append" work -->
          <include>proguard/*</include>
        </includes>
        <targetPath>META-INF</targetPath>
      </resource>
    </resources>
    <plugins>
      <plugin>

  // the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.
  // +optional
  repeated string apiGroups = 3;

  // Resources is a list of resources this rule applies to. '*' represents all resources.
  // +optional
  repeated string resources = 4;

- apiGroups:
  - metallb.io
  resources:
  - bgppeers
  verbs:
  - get
  - list
- apiGroups:
  - metallb.io
  resources:
  - addresspools
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - metallb.io
  resources:
  - bfdprofiles
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - metallb.io
  resources:
  - ipaddresspools
  verbs:

        try {
            final Enumeration<URL> resources = classLoader.getResources(path);

            while (resources.hasMoreElements()) {
                final URL resource = resources.nextElement();
                logger.debug("loading {}", resource);
                if ("file".equals(resource.getProtocol())) {
                    final File directory = new File(resource.getFile());

apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  labels:
    app: sidecar-injector
    install.operator.istio.io/owning-resource: example-istiocontrolplane
    install.operator.istio.io/owning-resource-namespace: istio-system
    istio.io/rev: default
    operator.istio.io/component: Pilot
    operator.istio.io/managed: Reconcile
    operator.istio.io/version: 1.14.0
    release: istio

    } catch (SecurityException expected) {
    }
    ClassPath classPath = ClassPath.from(getClass().getClassLoader());
    // ClassPath may contain resources from the boot class loader; just not from the class path.
    for (ResourceInfo resource : classPath.getResources()) {
      assertThat(resource.getResourceName()).doesNotContain("com/google/common/reflect/");
    }
  }

  private static ClassPath.ClassInfo findClass(