Name:           "webhook_rejection_count",

     */
    String renderSelector(VersionSelector selector);

    /**
     * Creates another version selector which complements the provided one, but also makes sense to use
     * in a rejection rule. It will therefore fail when computing a complement for this use case doesn't
     * make sense.
     * @param selector the selector to create a complement for

apiVersion: release-notes/v2
kind: bug-fix
area: networking
issue:
- 25691
releaseNotes:
- |

        "reject all": """{ ComponentSelection selection ->
                selection.reject("rejecting everything")
                candidates << selection.candidate.version
            }
            """,
        "reject all with metadata": """{ ComponentSelection selection ->
                if (selection.metadata != null) {
                    selection.reject("rejecting everything")
                    candidates << selection.candidate.version

        then:
        selector instanceof ExactVersionSelector
        selector.selector == '1.0'

        where:
        version << ["[1.0]", "[1.0, 1.0]"]
    }

    def "computes rejection selector for strict dependency version #selector"() {
        given:
        def normal = matcher.parseSelector(selector)

        when:
        def reject = matcher.complementForRejection(normal)

        then:

apiVersion: release-notes/v2
kind: feature
area: security
issue:
  - 26224
releaseNotes:
- |
  **Added** Trust Domain Validation by default rejecting requests in sidecars if the request is not from same trust domain

        "1.+"                | "select status" | "1.1"         | '["1.2", "1.1"]' | ['1.2', '1.1']     | false           | true             | ["didn't match versions 2.1, 2.0", "rejection: 1.2 by rule because not milestone"]

  namespace: testns
spec:
  host: ssl1.webinf.info
  trafficPolicy:
    loadBalancer:
      simple: LEAST_CONN
    tls:
      mode: SIMPLE
---
# This will not work: myCA not found, results in rejecting all clusters if the
# service exists.
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: drprefix
  namespace: testns
spec:
  host: "random.webinf.info"
  trafficPolicy:

	if err == nil {
		t.Errorf("Expected error rejecting creates in a namespace when it is missing")
	}

	// verify update operations in the namespace cause an error

        permissionRegistry.explicitAnalysisRestriction?.let { restriction ->
            return "Resolve is explicitly forbidden in the current action: ${restriction.description}."
        }

        error("Cannot get a rejection reason when analysis is allowed.")
    }

    private fun isProhibitedEdtAnalysis(application: Application): Boolean =
        application.isDispatchThread &&