// ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches.
  // The policy cares about an operation if it matches _any_ Rule.
  // +listType=atomic
  // +optional
  repeated NamedRuleWithOperations resourceRules = 3;

  // ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about.

import static com.google.common.base.Predicates.compose;
import static com.google.common.base.Predicates.in;
import static com.google.common.base.Predicates.not;
import static com.google.common.collect.Iterators.emptyIterator;
import static com.google.common.collect.Maps.immutableEntry;
import static java.util.Collections.emptyMap;
import static java.util.Objects.requireNonNull;

import com.google.common.annotations.GwtIncompatible;

import static com.google.common.collect.Iterators.advance;
import static com.google.common.collect.Iterators.all;
import static com.google.common.collect.Iterators.any;
import static com.google.common.collect.Iterators.elementsEqual;
import static com.google.common.collect.Iterators.emptyIterator;
import static com.google.common.collect.Iterators.filter;
import static com.google.common.collect.Iterators.find;

import static com.google.common.collect.CollectPreconditions.checkNonnegative;
import static com.google.common.collect.CollectPreconditions.checkRemove;
import static com.google.common.collect.Iterators.elementsEqual;
import static java.lang.Math.min;

import com.google.common.annotations.GwtCompatible;
import com.google.common.annotations.GwtIncompatible;
import com.google.common.annotations.J2ktIncompatible;

import static com.google.common.collect.Iterators.advance;
import static com.google.common.collect.Iterators.all;
import static com.google.common.collect.Iterators.any;
import static com.google.common.collect.Iterators.elementsEqual;
import static com.google.common.collect.Iterators.emptyIterator;
import static com.google.common.collect.Iterators.filter;
import static com.google.common.collect.Iterators.find;

     *
     * <ul>
     *   <li>If this field's value == currentThread, we know that it's up to date, because write
     *       operations in a thread always happen-before subsequent read operations in the same
     *       thread
     *   <li>If this field's value == null because of unsafe publication, we know that it isn't the

	MTime                time.Time // Is only set in POST/PUT operations
	Expires              time.Time // Is only used in POST/PUT operations

	DeleteMarker            bool // Is only set in DELETE operations for delete marker replication
	CheckDMReplicationReady bool // Is delete marker ready to be replicated - set only during HEAD
	Tagging                 bool // Is only in GET/HEAD operations to return tagging metadata along with regular metadata and body.

 * views are modifiable.
 *
 * <p>This class is not threadsafe when any concurrent operations update the multimap. Concurrent
 * read operations will work correctly. To allow concurrent update operations, wrap your multimap
 * with a call to {@link Multimaps#synchronizedSetMultimap}.
 *

     */
    public MultiIterator(final Iterator<E>... iterators) {
        assertArgumentNotNull("iterators", iterators);
        this.iterators = iterators;
    }

    @Override
    public boolean hasNext() {
        for (; index < iterators.length; ++index) {
            if (iterators[index].hasNext()) {
                return true;
            }
        }
        return false;
    }

			Args: strings.Split(
				"--operatorFileName testdata/istio-operator.yaml"+
					" --injectConfigFile testdata/inject-config-iop.yaml -f testdata/deployment/hello.yaml",
				" "),
			GoldenFilename: "testdata/deployment/hello.yaml.iop.injected",
		},
		{ // case 5 with only iop files
			Args: strings.Split(
				"--operatorFileName testdata/istio-operator.yaml"+