import (
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/inverse/allowed"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/inverse/allowed/a1"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/inverse/forbidden"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/inverse/forbidden/f1"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/inverse/neither"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/inverse/neither/n1"
)

import (
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/transitive/allowed"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/transitive/allowed/a1"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/transitive/forbidden"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/transitive/forbidden/f1"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/transitive/neither"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/transitive/neither/n1"
)

		if subject.User != nil {
			allErrs = append(allErrs, field.Forbidden(fldPath.Child("user"), "user is forbidden when subject kind is not 'User'"))
		}
		if subject.Group != nil {
			allErrs = append(allErrs, field.Forbidden(fldPath.Child("group"), "group is forbidden when subject kind is not 'Group'"))
		}
	case flowcontrol.SubjectKindUser:

import (
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/simple-fwd/allowed"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/simple-fwd/allowed/a1"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/simple-fwd/forbidden"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/simple-fwd/forbidden/f1"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/simple-fwd/neither"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/simple-fwd/neither/n1"
)

		allErrs = append(allErrs, field.Forbidden(fldPath.Child("default"), "must be undefined to be structural"))
	}
	if len(v.ForbiddenGenerics.Title) > 0 {
		allErrs = append(allErrs, field.Forbidden(fldPath.Child("title"), "must be empty to be structural"))
	}
	if len(v.ForbiddenGenerics.Description) > 0 {
		allErrs = append(allErrs, field.Forbidden(fldPath.Child("description"), "must be empty to be structural"))
	}

		node.Labels = map[string]string{}
	}
	if value == "" {
		value = "value"
	}
	// node restriction labels are forbidden
	node.Labels["node-restriction.kubernetes.io/foo"] = value
	node.Labels["foo.node-restriction.kubernetes.io/foo"] = value
	// arbitrary kubernetes labels are forbidden on update
	node.Labels["other.kubernetes.io/foo"] = value
	node.Labels["other.k8s.io/foo"] = value
	return node
}

		}
		if len(errs) != 0 && typeName == "object" {
			t.Errorf("unexpected forbidden field validation errors for: %#v", s)
		}
		if len(errs) == 0 && typeName != "object" {
			t.Errorf("expected forbidden field validation errors for: %#v", s)
		}
	}

	// check that anything other than name and generateName of ObjectMeta in metadata properties is forbidden
	tt := reflect.TypeOf(metav1.ObjectMeta{})
	for i := 0; i < tt.NumField(); i++ {

      - k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/allowed-by-both
    forbiddenPrefixes:
      - k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/forbidden-by-root

		restrictionViolated := false
		for _, pkg := range packages {
			if forbidden, err := restriction.ForbiddenImportsFor(pkg); err != nil {
				log.Fatalf("-- failed to validate imports: %v", err)
			} else if len(forbidden) != 0 {
				logForbiddenPackages(pkg.ImportPath, forbidden)
				restrictionViolated = true
			}
		}
		if restrictionViolated {
			foundForbiddenImports = true

func (r Rule) Evaluate(imp string) Disposition {
	// To pass, an import muct be allowed and not forbidden.
	// Check forbidden first.
	for _, forbidden := range r.ForbiddenPrefixes {
		klog.V(5).Infof("checking %q against forbidden prefix %q", imp, forbidden)
		if hasPathPrefix(imp, forbidden) {
			klog.V(5).Infof("this import of %q is forbidden", imp)
			return DepForbidden
		}
	}
	for _, allowed := range r.AllowedPrefixes {