optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Rules holds all the PolicyRules for this ClusterRole
  // +optional
  repeated PolicyRule rules = 2;

  // AggregationRule is an optional field that describes how to build the Rules for this ClusterRole.
  // If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be
  // stomped by the controller.
  // +optional

				return
			}
		case "Rules":
			var zb0002 uint32
			zb0002, err = dc.ReadArrayHeader()
			if err != nil {
				err = msgp.WrapError(err, "Rules")
				return
			}
			if cap(z.Rules) >= int(zb0002) {
				z.Rules = (z.Rules)[:zb0002]
			} else {
				z.Rules = make([]BatchJobExpireFilter, zb0002)
			}
			for za0001 := range z.Rules {
				err = z.Rules[za0001].DecodeMsg(dc)
				if err != nil {

  // For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
  // but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
  // a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the webhook.
  //
  // - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version.

package event

// RulesMap - map of rules for every event name.
type RulesMap map[Name]Rules

// add - adds event names, prefixes, suffixes and target ID to rules map.
func (rulesMap RulesMap) add(eventNames []Name, pattern string, targetID TargetID) {
	rules := make(Rules)
	rules.Add(pattern, targetID)

	for _, eventName := range eventNames {

	nameSet := set.NewStringSet()
	for _, rule := range rules.Rules {
		if nameSet.Contains(rule.Name) {
			if rule.Name == "prefix" {
				return &ErrFilterNamePrefix{}
			}

			return &ErrFilterNameSuffix{}
		}

		nameSet.Add(rule.Name)
	}

	*ruleList = FilterRuleList(rules)
	return nil
}

func (ruleList FilterRuleList) isEmpty() bool {

  // ingress supports SNI.
  // +optional
  repeated IngressTLS tls = 2;

  // rules is a list of host rules used to configure the Ingress. If unspecified, or
  // no rule matches, all traffic is sent to the default backend.
  // +optional
  repeated IngressRule rules = 3;
}

// IngressStatus describes the current state of the Ingress.
message IngressStatus {

import gradlebuild.binarycompatibility.rules.KotlinModifiersBreakingChangeRule
import gradlebuild.binarycompatibility.rules.MethodsRemovedInInternalSuperClassRule
import gradlebuild.binarycompatibility.rules.NewIncubatingAPIRule
import gradlebuild.binarycompatibility.rules.NullabilityBreakingChangesRule
import gradlebuild.binarycompatibility.rules.SinceAnnotationMissingRule

               "rules": {
                "policies": {
                 "ns[default]-policy[httpbin]-rule[0]": {
                  "permissions": [
                   {
                    "and_rules": {
                     "rules": [
                      {
                       "or_rules": {
                        "rules": [
                         {

		{
			inputXML:    `<ServerSideEncryptionConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Rule><ApplyServerSideEncryptionByDefault><SSEAlgorithm>AES256</SSEAlgorithm></ApplyServerSideEncryptionByDefault></Rule><Rule><ApplyServerSideEncryptionByDefault><SSEAlgorithm>AES256</SSEAlgorithm></ApplyServerSideEncryptionByDefault></Rule></ServerSideEncryptionConfiguration>`,
			expectedErr: errors.New("only one server-side encryption rule is allowed at a time"),

This JSON rule is equivalent to the following MinIO Client command:
```
mc ilm rule add --noncurrent-expire-days 30 --noncurrent-expire-newer 5 myminio/mydata
```

#### 3.2.a Automatic removal of noncurrent versions keeping only most recent ones immediately (MinIO only extension)

This is available only on MinIO as an extension to the NewerNoncurrentVersions feature. The following rule makes it possible to remove older noncurrent versions