{{- /* Note: if both revision and legacy selector, we give precedence to the legacy one */}}
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
  namespaceSelector:
    matchExpressions:
    - key: istio.io/rev
      operator: In
      values:
      {{- if (eq .Values.revision "") }}
      - "default"
      {{- else }}
      - "{{ .Values.revision }}"

		expectCallKind        schema.GroupVersionKind
		matchError            error
		matchResult           bool
	}{
		{
			name:        "no rules (just write)",
			webhook:     &v1.ValidatingWebhook{NamespaceSelector: &metav1.LabelSelector{}, Rules: []v1.RuleWithOperations{}},

				},
			},
			expected: &v1alpha1.ValidatingAdmissionPolicy{
				Spec: v1alpha1.ValidatingAdmissionPolicySpec{
					MatchConstraints: &v1alpha1.MatchResources{
						MatchPolicy:       &equivalent,
						NamespaceSelector: &metav1.LabelSelector{},
						ObjectSelector:    &metav1.LabelSelector{},
					},
					FailurePolicy: &fail,
				},
			},
		},
		{
			name: "ValidatingAdmissionPolicyBinding",

                      properties:
                        namespaceSelector:
                          description: "NamespaceSelector is an optional field that
                            contains a selector expression. Only traffic that originates
                            from (or terminates at) endpoints within the selected
                            namespaces will be matched. When both NamespaceSelector

                      properties:
                        namespaceSelector:
                          description: "NamespaceSelector is an optional field that
                            contains a selector expression. Only traffic that originates
                            from (or terminates at) endpoints within the selected
                            namespaces will be matched. When both NamespaceSelector

                  "operator": "operatorValue",
                  "values": [
                    "valuesValue"
                  ]
                }
              ]
            },
            "namespaceSelector": {
              "matchLabels": {
                "matchLabelsKey": "matchLabelsValue"
              },
              "matchExpressions": [
                {
                  "key": "keyValue",

spec:
  egress:
  - ports:
    - endPort: 3
      port: portValue
      protocol: protocolValue
    to:
    - ipBlock:
        cidr: cidrValue
        except:
        - exceptValue
      namespaceSelector:
        matchExpressions:
        - key: keyValue
          operator: operatorValue
          values:
          - valuesValue
        matchLabels:
          matchLabelsKey: matchLabelsValue

                  "operator": "operatorValue",
                  "values": [
                    "valuesValue"
                  ]
                }
              ]
            },
            "namespaceSelector": {
              "matchLabels": {
                "matchLabelsKey": "matchLabelsValue"
              },
              "matchExpressions": [
                {
                  "key": "keyValue",

                  "operator": "operatorValue",
                  "values": [
                    "valuesValue"
                  ]
                }
              ]
            },
            "namespaceSelector": {
              "matchLabels": {
                "matchLabelsKey": "matchLabelsValue"
              },
              "matchExpressions": [
                {
                  "key": "keyValue",

  namespace: istio-system
  labels:
    monitoring: istio-proxies
    release: istio
spec:
  selector:
    matchExpressions:
    - {key: istio-prometheus-ignore, operator: DoesNotExist}
  namespaceSelector:
    any: true
  jobLabel: envoy-stats
  podMetricsEndpoints:
  - path: /stats/prometheus
    interval: 15s
    relabelings:
    - action: keep
      sourceLabels: [__meta_kubernetes_pod_container_name]