"default": "",
              "type": "string"
            },
            "type": "array",
            "x-kubernetes-list-type": "set"
          },
          "clusterScope": {

						}},
						ResourceRules: []flowcontrol.ResourcePolicyRule{{
							Verbs:        all,
							APIGroups:    all,
							Resources:    all,
							ClusterScope: true,
							Namespaces:   all,
						}},
					}, {
						Subjects: []flowcontrol.Subject{{
							Kind:  flowcontrol.SubjectKindGroup,

		allErrors = append(allErrors, field.Invalid(fldPath, resources, "if '*' is present, must not specify other resources"))
	}
	return allErrors
}

var validScopes = sets.NewString(
	string(admissionregistration.ClusterScope),
	string(admissionregistration.NamespacedScope),
	string(admissionregistration.AllScopes),
)

func validateRule(rule *admissionregistration.Rule, fldPath *field.Path, allowSubResource bool) field.ErrorList {

		{"Wrong Namespace", []string{"ns/*"}, allContains("other-ns", false)},
		{"No Sidecar", nil, allContains("ns", true)},
		{"No Sidecar Other Namespace", nil, allContains("other-ns", false)},
		{"clusterScope resource", []string{"*/*"}, map[ConfigKey]bool{
			{kind.AuthorizationPolicy, "authz", "default"}: true,
		}},
	}
	for _, tt := range cases {
		t.Run(tt.name, func(t *testing.T) {
			cfg := &config.Config{

		ProtoPackage: "istio.io/api/security/v1beta1", StatusPackage: "istio.io/api/meta/v1alpha1",
		ClusterScoped: false,
		Synthetic:     false,
		Builtin:       false,
		ValidateProto: validation.ValidateAuthorizationPolicy,
	}.MustBuild()

	CertificateSigningRequest = resource.Builder{

		ProtoPackage: "istio.io/api/security/v1beta1", StatusPackage: "istio.io/api/meta/v1alpha1",
		ClusterScoped: false,
		Synthetic:     false,
		Builtin:       false,
		ValidateProto: validation.ValidateAuthorizationPolicy,
	}.MustBuild()

	DestinationRule = resource.Builder{
		Identifier: "DestinationRule",

	tests := []struct {
		Name            string
		ValidVersions   []string
		ClusterScoped   bool
		ToVersion       string
		SourceObject    runtime.Object
		ExpectedObject  runtime.Object
		ExpectedFailure string
	}{
		{
			Name:          "simple_conversion",
			ValidVersions: []string{"example.com/v1", "example.com/v2"},
			ClusterScoped: false,
			ToVersion:     "example.com/v2",
			SourceObject: &unstructured.Unstructured{

    version: "v1"
    clusterScoped: true
    builtin: true
    specless: true
    proto: "k8s.io.api.admissionregistration.v1.MutatingWebhookConfiguration"
    protoPackage: "k8s.io/api/admissionregistration/v1"

  - kind: "ValidatingWebhookConfiguration"
    plural: "validatingwebhookconfigurations"
    group: "admissionregistration.k8s.io"
    version: "v1"
    clusterScoped: true
    builtin: true

			return c.{{.ClientGetter}}().{{ .ClientGroupPath }}().{{ .ClientTypePath }}({{if not .Resource.ClusterScoped}}opts.Namespace{{end}}).List(context.Background(), options)
		}
		w = func(options metav1.ListOptions) (watch.Interface, error) {
			return c.{{.ClientGetter}}().{{ .ClientGroupPath }}().{{ .ClientTypePath }}({{if not .Resource.ClusterScoped}}opts.Namespace{{end}}).Watch(context.Background(), options)
		}
	{{- end }}
{{- end }}
  default:

{{- range $entry := .Entries }}
	{{- if not $entry.Resource.Synthetic }}
	case {{$entry.Resource.Identifier}}:
		return {{$entry.Resource.ClusterScoped}}
	{{- range $alias := .Resource.VersionAliases }}
    case {{$entry.Resource.Identifier}}_{{$alias}}:
        return {{$entry.Resource.ClusterScoped}}
	{{- end }}
    {{- end }}
{{- end }}
	}
	// shouldn't happen
	return false