- Dropping packets for services with `Local` traffic policy but no local endpoints.

  - Rejecting packets for services with no local or remote endpoints.
 
  - Dropping packets to ClusterIPs which are not yet allocated.

  - Rejecting packets to undefined ports of ClusterIPs.

This is implemented as follows:

        expect:
        v.requiredVersion == ''
        v.preferredVersion == ''
        v.strictVersion =='1.0'
        v.rejectedVersions == []
    }

    def "cannot mutate rejection list"() {
        given:
        def v = new DefaultImmutableVersionConstraint('1.1', '1.0', '1.1.1', ['1.2', '2.0'], null)

        when:
        v.rejectedVersions.add('3.0')

        then:

		if writeInfo {
			info = &Info{
				Types:      make(map[ast.Expr]TypeAndValue),
				Defs:       make(map[*ast.Ident]Object),
				Uses:       make(map[*ast.Ident]Object),
				Implicits:  make(map[ast.Node]Object),
				Selections: make(map[*ast.SelectorExpr]*Selection),
				Scopes:     make(map[ast.Node]*Scope),
			}
		}
		if _, err := conf.Check(path, fset, files, info); err != nil {
			b.Fatal(err)
		}
	}
	b.StopTimer()

	//     *ast.Field         anonymous parameter *Var (incl. unnamed results)
	//
	Implicits map[ast.Node]Object

	// Selections maps selector expressions (excluding qualified identifiers)
	// to their corresponding selections.
	Selections map[*ast.SelectorExpr]*Selection

	// Scopes maps ast.Nodes to the scopes they define. Package scopes are not

	if con == nil || con.proxy == nil {
		return nil
	}

	if features.EnableXDSIdentityCheck && identities != nil {
		// TODO: allow locking down, rejecting unauthenticated requests.
		id, err := checkConnectionIdentity(con.proxy, identities)
		if err != nil {
			log.Warnf("Unauthorized XDS: %v with identity %v: %v", con.Peer(), identities, err)

			info = &Info{
				Types:      make(map[syntax.Expr]TypeAndValue),
				Defs:       make(map[*syntax.Name]Object),
				Uses:       make(map[*syntax.Name]Object),
				Implicits:  make(map[syntax.Node]Object),
				Selections: make(map[*syntax.SelectorExpr]*Selection),
				Scopes:     make(map[syntax.Node]*Scope),
			}
		}
		if _, err := conf.Check(path, files, info); err != nil {
			b.Fatal(err)
		}
	}
	b.StopTimer()

			`,
			observer: func() {
				Metrics.ObserveAdmissionWithError(context.TODO(), time.Duration(10)*time.Second, "policy.example.com", "binding.example.com", "active")
			},
		},
		{
			desc: "observe policy rejection",
			want: `

	//     *syntax.Field         anonymous parameter *Var (incl. unnamed results)
	//
	Implicits map[syntax.Node]Object

	// Selections maps selector expressions (excluding qualified identifiers)
	// to their corresponding selections.
	Selections map[*syntax.SelectorExpr]*Selection

	// Scopes maps syntax.Nodes to the scopes they define. Package scopes are not

May be followed by a `because` text.

| Rejection : <version> by rule because <text>
| A `ComponentSelection.reject` link:{groovyDslPath}/org.gradle.api.artifacts.ComponentSelection.html#org.gradle.api.artifacts.ComponentSelection:reject(java.lang.String)[rejected the given version] of the dependency.

| Rejection: version <version>: <attributes information>

		// So does a line with just a pipe:
		// https://github.com/github/cmark-gfm/pull/127 and
		// https://github.com/github/cmark-gfm/pull/128
		// fixed a buffer overread by rejecting | by itself as a table line.
		// That seems to violate the spec, but we will play along.
		b = nil
	}

	// If we are looking for tables and this is a table start, start a table.