// `rules` describes which requests will match this flow schema. This FlowSchema matches a request if and only if
  // at least one member of rules matches the request.
  // if it is an empty slice, there will be no requests matching the FlowSchema.
  // +listType=atomic
  // +optional
  repeated PolicyRulesWithSubjects rules = 4;
}

  // `rules` describes which requests will match this flow schema. This FlowSchema matches a request if and only if
  // at least one member of rules matches the request.
  // if it is an empty slice, there will be no requests matching the FlowSchema.
  // +listType=atomic
  // +optional
  repeated PolicyRulesWithSubjects rules = 4;
}

					rules[5],
				},
			},
			opts: ObjectOpts{
				IsLatest: true,
				UserTags: "key1=val1",
				Name:     "obj-1",
				Size:     1*humanize.MiByte - 1,
			},
			hasRules: true,
		},
		{ // PUT version with size based filters
			lc: Lifecycle{
				Rules: []Rule{
					rules[1],
					rules[2],
					rules[3],
					rules[4],
					rules[5],
				},
			},

  repeated k8s.io.api.admissionregistration.v1.RuleWithOperations rules = 3;

  // FailurePolicy defines how unrecognized errors from the admission endpoint are handled -
  // allowed values are Ignore or Fail. Defaults to Ignore.
  // +optional
  optional string failurePolicy = 4;

  // matchPolicy defines how the "rules" list is used to match incoming requests.
  // Allowed values are "Exact" or "Equivalent".
  //

	}
	// pod is removed from the mesh, but is still running. remove iptables rules
	log.Debugf("calling DeleteInpodRules.")
	if err := s.netnsRunner(openNetns, func() error { return s.iptablesConfigurator.DeleteInpodRules() }); err != nil {
		log.Errorf("failed to delete inpod rules %v", err)
		return fmt.Errorf("failed to delete inpod rules %w", err)
	}

			}
		}
		return err
	}

	if len(r.Rules) > maxBatchRules {
		return batchExpireJobError{
			Code:           "InvalidArgument",
			Description:    "Too many rules. Batch expire job can't have more than 100 rules",
			HTTPStatusCode: http.StatusBadRequest,
		}
	}

	for _, rule := range r.Rules {
		if err := rule.Validate(); err != nil {
			return batchExpireJobError{

	}

	// Create hostprobe rules now, in the host netns
	// Later we will reuse this same configurator inside the pod netns for adding other rules
	iptablesConfigurator.DeleteHostRules()

	if err := iptablesConfigurator.CreateHostRulesForHealthChecks(&HostProbeSNATIP, &HostProbeSNATIPV6); err != nil {
		return nil, fmt.Errorf("error initializing the host rules for health checks: %w", err)
	}

    release: {{ .Release.Name }}
    istio.io/rev: {{ .Values.revision | default "default" }}
    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
    operator.istio.io/component: "Cni"
rules:
- apiGroups: [""]
  resources: ["pods","nodes","namespaces"]
  verbs: ["get", "list", "watch"]
{{- if (eq .Values.platform "openshift") }}
- apiGroups: ["security.openshift.io"]
  resources: ["securitycontextconstraints"]

  repeated RuleWithOperations rules = 3;

  // FailurePolicy defines how unrecognized errors from the admission endpoint are handled -
  // allowed values are Ignore or Fail. Defaults to Fail.
  // +optional
  optional string failurePolicy = 4;

  // matchPolicy defines how the "rules" list is used to match incoming requests.
  // Allowed values are "Exact" or "Equivalent".
  //

					DeleteReplication:       DeleteReplication{Status: Disabled},
					Filter:                  Filter{Prefix: "xyz"},
				},
			},
		},
		{ // Config3 - Replication config has filters and no overlapping rules
			Rules: []Rule{
				{
					Status:                  Enabled,
					Priority:                2,
					DeleteMarkerReplication: DeleteMarkerReplication{Status: Disabled},