<testSourceDirectory>${project.basedir}/src/test/java</testSourceDirectory>
    <resources>
      <resource>
        <directory>${project.basedir}/src/main/resources</directory>
      </resource>
      <resource>
        <directory>${project.basedir}/src/main/resources-filtered</directory>
        <filtering>true</filtering>
      </resource>
    </resources>
    <testResources>
      <testResource>

  // +optional
  optional string apiGroup = 1;

  // Kind is the type of resource being referenced. This is the same
  // value as in the parameter object's metadata.
  optional string kind = 2;

  // Name is the name of resource being referenced.
  optional string name = 3;

  // Namespace that contains the referenced resource. Must be empty

  // the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.
  // +optional
  repeated string apiGroups = 2;

  // Resources is a list of resources this rule applies to.  '*' represents all resources in the specified apiGroups.

    <testSourceDirectory>${project.basedir}/src/test/java</testSourceDirectory>
    <resources>
      <resource>
        <directory>${project.basedir}/src/main/resources</directory>
      </resource>
      <resource>
        <directory>${project.basedir}/src/main/resources-filtered</directory>
        <filtering>true</filtering>
      </resource>
    </resources>
    <testResources>
      <testResource>

  // Group is the API Group of the Resource.  "*" means all.
  // +optional
  optional string group = 3;

  // Version is the API Version of the Resource.  "*" means all.
  // +optional
  optional string version = 4;

  // Resource is one of the existing resource types.  "*" means all.
  // +optional
  optional string resource = 5;

  // Subresource is one of the existing resource types.  "" means none.
  // +optional

apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  labels:
    app: sidecar-injector
    install.operator.istio.io/owning-resource: unknown
    install.operator.istio.io/owning-resource-namespace: istio-system
    istio.io/rev: 1-16
    operator.istio.io/component: Pilot
    operator.istio.io/managed: Reconcile
    operator.istio.io/version: 1.16-alpha.91e471de3e8fc93ebb545cedf396ddbd550b996c
    release: istio

  // Required.
  repeated string apiGroups = 2;

  // `resources` is a list of matching resources (i.e., lowercase
  // and plural) with, if desired, subresource.  For example, [
  // "services", "nodes/status" ].  This list may not be empty.
  // "*" matches all resources and, if present, must be the only entry.
  // Required.
  // +listType=set
  repeated string resources = 3;

{{- range $i, $statement := .statements }}
    {
      "Effect": "{{ $statement.effect | default "Allow" }}",
      "Action": [
"{{ $statement.actions | join "\",\n\"" }}"
      ]{{ if $statement.resources }},
      "Resource": [
"{{ $statement.resources | join "\",\n\"" }}"
      ]{{ end }}
{{- if $statement.conditions }}
{{- $condition_len := len $statement.conditions }}
{{- $condition_len := sub $condition_len 1 }}
      ,

  // the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.
  // +optional
  repeated string apiGroups = 2;

  // Resources is a list of resources this rule applies to. '*' represents all resources.
  // +optional
  repeated string resources = 3;

  // Kind is the API kind the resources belong to.
  // Required.
  optional string kind = 2;
}

// ParamRef references a parameter resource
// +structType=atomic
message ParamRef {
  // Name of the resource being referenced.
  optional string name = 1;

  // Namespace of the referenced resource.
  // Should be empty for the cluster-scoped resources
  // +optional
  optional string namespace = 2;
}