}

// ResourcePolicyRule is a predicate that matches some resource
// requests, testing the request's verb and the target resource. A
// ResourcePolicyRule matches a resource request if and only if: (a)
// at least one member of verbs matches the request, (b) at least one
// member of apiGroups matches the request, (c) at least one member of
// resources matches the request, and (d) either (d1) the request does

}

// ResourcePolicyRule is a predicate that matches some resource
// requests, testing the request's verb and the target resource. A
// ResourcePolicyRule matches a resource request if and only if: (a)
// at least one member of verbs matches the request, (b) at least one
// member of apiGroups matches the request, (c) at least one member of
// resources matches the request, and (d) either (d1) the request does

  // Required
  optional string namespace = 1;

  // `name` is the name of the service.
  // Required
  optional string name = 2;

  // `path` is an optional URL path which will be sent in any request to
  // this service.
  // +optional
  optional string path = 3;

  // If specified, the port on the service that hosting webhook.
  // Default to 443 for backward compatibility.

		port := retrieveListenerPort(l)
		if filter.Verbose {

			matches := retrieveListenerMatches(l)
			sort.Slice(matches, func(i, j int) bool {
				return matches[i].destination > matches[j].destination
			})
			for _, match := range matches {
				if includeConfigType {
					name := fmt.Sprintf("listener/%s", l.Name)

		if nsMatched && podMatched {
			if nsLabel != "" && podLabel != "" {
				return fmt.Sprintf("Namespace label %s matches, and pod label %s matches", nsLabel, podLabel), true
			} else if nsLabel != "" {
				outMsg := fmt.Sprintf("Namespace label %s matches", nsLabel)
				if strings.Contains(nsLabel, "kubernetes.io/metadata.name") {
					outMsg += " (Automatic injection is enabled in all namespaces)."
				}

  // Required
  optional string namespace = 1;

  // `name` is the name of the service.
  // Required
  optional string name = 2;

  // `path` is an optional URL path which will be sent in any request to
  // this service.
  // +optional
  optional string path = 3;

  // If specified, the port on the service that hosting webhook.
  // Default to 443 for backward compatibility.

  // set by the controller component of the resource driver whose name
  // matches the DriverName set in the ResourceClaimStatus this
  // ResourceHandle is embedded in. It is set at allocation time and is
  // intended for processing by the kubelet plugin whose name matches
  // the DriverName set in this ResourceHandle.
  //
  // The maximum size of this field is 16KiB. This may get increased in the

end }} volumes: # Used to install CNI. - name: cni-bin-dir hostPath: path: {{ .Values.cni.cniBinDir | default $defaultBinDir }} {{- if .Values.cni.ambient.enabled }} - name: cni-ambient-config-dir hostPath: path: {{ .Values.cni.ambient.configDir | default "/etc/ambient-config" }} {{- end }} - name: cni-net-dir hostPath: path: {{ default "/etc/cni/net.d" .Values.cni.cniConfDir }} # Used for UDS log - name: cni-log-dir hostPath: path: /var/run/istio-cni - name: cni-netns-dir hostPath: path: {{ .Values.cni.cniNetnsDir...

  portLevelMtls:
    9090:
      mode: PERMISSIVE
```

will be translated into this `Authorization`:

```yaml
action: DENY
groups:
- rules:
  - matches:
    - notPrincipals:
      - presence: {}
- rules:
  - matches:
    - notDestinationPorts:
      - 9090
name: converted_peer_authentication_strict-and-permissive-mtls
scope: WORKLOAD_SELECTOR
```

"This is not json"