apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: reviews
  namespace: default
spec:
  host: reviews
  subsets:
  - labels:
      version: v1
    name: v1
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: reviews
  namespace: default
spec:
  http:
  - route:
    - destination:  # This virtualservice has no validation errors (base case)

		want runtime.Object
	}{
		{
			json: []byte(`{"apiVersion": "test", "kind": "test_kind"}`),
			want: &unstructured.Unstructured{
				Object: map[string]interface{}{"apiVersion": "test", "kind": "test_kind"},
			},
		},
		{
			json: []byte(`{"apiVersion": "test", "kind": "test_list", "items": []}`),
			want: &unstructured.UnstructuredList{
				Object: map[string]interface{}{"apiVersion": "test", "kind": "test_list"},

apiVersion: v1
items:
- aggregationRule:
    clusterRoleSelectors:
    - matchLabels:
        rbac.authorization.k8s.io/aggregate-to-admin: "true"
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    annotations:
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: admin
  rules: null

# Broken config in a yaml config file
#
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: httpbin-gateway
spec:
  selector:
    istio: ingressgateway
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: crossnamespace-gw
  namespace: another
spec:
  selector:
    istio: ingressgateway
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: httpbin-1
  namespace: foo
spec:
  selector:
    matchLabels:
      app: httpbin
      version: v1
  rules:
  - to:
    - operation:
        methods: ["GET", "POST"]
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: httpbin-2
  namespace: foo
spec:
  selector:
    matchLabels:

# Gateways for 8001 and 8002 correct matching
#
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: httpbin8001-gateway
spec:
  selector:
    myapp: ingressgateway-8001
  servers:
  - port:
      number: 8001
      name: http2
      protocol: HTTP
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: httpbin8002-gateway
spec:
  selector:

apiVersion: v1
items:
- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    annotations:
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:controller:attachdetach-controller
  rules:
  - apiGroups:
    - ""
    resources:
    - persistentvolumeclaims
    - persistentvolumes
    verbs:

# Same service as cluster2, should not report warning.
apiVersion: v1
kind: Service
metadata:
  name: my-service
  namespace: my-namespace
spec:
  selector:
    app: my-service
  ports:
  - name: tcp-foo
    protocol: TCP
    port: 8080
    targetPort: 8080
---
# Service with extra port in cluster2, should generate warning.
apiVersion: v1
kind: Service
metadata:
  name: extra-port
  namespace: my-namespace
spec:

apiVersion: v1
data:
  cert: aHVzaCBodXNoIGh1c2gK
  key: c2VjcmV0IHNlY3JldAo=
kind: Secret
metadata:
  name: invalid-key
  namespace: istio-system
type: Opaque
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: defaultgateway-invalid-keys
spec:
  selector:
    istio: ingressgateway # use istio default ingress gateway, so we expect the credential in istio-system
  servers:
    - port:

{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user":"admin", "namespace": "*", "resource": "*", "apiGroup": "*", "nonResourcePath": "*"}}
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user":"{{kube_user}}", "namespace": "*", "resource": "*", "apiGroup": "*", "nonResourcePath": "*"}}