package allowed

import (
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/inverse/allowed/a2"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/inverse/forbidden/f2"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/inverse/neither/n2"
)

package main

func main() {
	if var x = 0; x < 10 {}    // ERROR "var declaration not allowed in if initializer"

	switch var x = 0; x {}     // ERROR "var declaration not allowed in switch initializer"

	for var x = 0; x < 10; {}  // ERROR "var declaration not allowed in for initializer"

	"":                "SubjectAccessReviewStatus",
	"allowed":         "Allowed is required. True if the action would be allowed, false otherwise.",
	"denied":          "Denied is optional. True if the action would be denied, otherwise false. If both allowed is false and denied is false, then the authorizer has no opinion on whether to authorize the action. Denied may not be true if Allowed is true.",

}

var map_ImageReviewStatus = map[string]string{
	"":                 "ImageReviewStatus is the result of the review for the pod creation request.",
	"allowed":          "Allowed indicates that all images were allowed to be run.",
	"reason":           "Reason should be empty unless Allowed is false in which case it may contain a short description of what is wrong.  Kubernetes may truncate excessively long errors when displaying to the user.",

      protocol: TCP
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  annotations:
    internal.istio.io/parents: TCPRoute/allowed-my-svc.istio-system
    internal.istio.io/route-semantics: gateway
  creationTimestamp: null
  name: allowed-my-svc-tcp-0-istio-autogenerated-k8s-gateway
  namespace: istio-system
spec:
  gateways:
  - istio-system/gateway-istio-autogenerated-k8s-gateway-my-svc
  hosts:

// for code that resides in the standard library.
package issue18331

//go:unknown // ERROR "//go:unknown is not allowed in the standard library"
func foo()

//go:nowritebarrierc // ERROR "//go:nowritebarrierc is not allowed in the standard library"
func bar()

//go:noesape // ERROR "//go:noesape is not allowed in the standard library"
func groot()

//go:noescape

package aaa

import (
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/allowed-by-both"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/allowed-by-root"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/allowed-by-sub"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/bbb"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/forbidden-by-both"
	_ "k8s.io/kubernetes/cmd/import-boss/testdata/nested-fwd/forbidden-by-root"

  optional string namespace = 3;
}

// ImageReviewStatus is the result of the review for the pod creation request.
message ImageReviewStatus {
  // Allowed indicates that all images were allowed to be run.
  optional bool allowed = 1;

  // Reason should be empty unless Allowed is false in which case it
  // may contain a short description of what is wrong.  Kubernetes
  // may truncate excessively long errors when displaying to the user.

  repeated AllowedCSIDriver allowedCSIDrivers = 23;

  // allowedUnsafeSysctls is a list of explicitly allowed unsafe sysctls, defaults to none.
  // Each entry is either a plain sysctl name or ends in "*" in which case it is considered
  // as a prefix of allowed sysctls. Single * means all unsafe sysctls are allowed.
  // Kubelet has to allowlist all allowed unsafe sysctls explicitly to avoid rejection.
  //
  // Examples:

}

// SubjectAccessReviewStatus
type SubjectAccessReviewStatus struct {
	// Allowed is required. True if the action would be allowed, false otherwise.
	Allowed bool `json:"allowed" protobuf:"varint,1,opt,name=allowed"`
	// Denied is optional. True if the action would be denied, otherwise
	// false. If both allowed is false and denied is false, then the
	// authorizer has no opinion on whether to authorize the action. Denied