type PolicyWithBindings struct {
    Policy   admissionregistrationv1.ValidatingAdmissionPolicy
    Bindings []admissionregistrationv1.ValidatingAdmissionPolicyBinding
}

type ValidatingAdmissionPolicyGenerator interface {
	Name() string
	Validate() error
    PoliciesWithBindings() []PolicyWithBindings
}

var AdmissionPolicyManagerLabels = map[string]string{
    VAPManagedByKubeFleetLabelKey:  VAPManagedByKubeFleetLabelValue,
    VAPPartOfKubeFleetLabelKey:     VAPPartOfKubeFleetLabelValue,
    VAPComponentKubeFleetLabelKey:  VAPComponentAdmissionPolicyManagerLabelValue,
}

maps.Copy(policy.Labels, AdmissionPolicyManagerLabels)

var AdmissionPolicyManagerLabels = map[string]string{
    VAPManagedByKubeFleetLabelKey:  VAPManagedByKubeFleetLabelValue,
    VAPPartOfKubeFleetLabelKey:     VAPPartOfKubeFleetLabelValue,
    VAPComponentKubeFleetLabelKey:  VAPComponentAdmissionPolicyManagerLabelValue,
}

maps.Copy(policyBinding.Labels, AdmissionPolicyManagerLabels)

func retryOnAnyErrorUnlessCancelled(ctx context.Context) func(error) bool {
    return func(err error) bool {
        return ctx.Err() == nil
    }
}

retry.OnError(policyRWOpBackoff, retryOnAnyErrorUnlessCancelled(ctx), func() error {
    // ...
})

// ValidateCELStringLiterals checks that none of the values contain characters
// that would break or inject into a CEL double-quoted string literal.
// The fieldName is used in the error message for context.
func ValidateCELStringLiterals(values []string, fieldName string) error {
    for _, v := range values {
        if strings.ContainsAny(v, `"\`) {
            return errors.NewUserError(nil,
                fmt.Sprintf("%s contains characters illegal in a CEL string literal", fieldName),
                fieldName, v)
        }
    }
    return nil
}

    if err := ValidateCELStringLiterals(g.WhitelistedUsernames, "whitelisted username"); err != nil {
        return err
    }
    if err := ValidateCELStringLiterals(g.WhitelistedUserGroups, "whitelisted user group"); err != nil {
        return err
    }

// CELExpr represents a CEL expression fragment.
type CELExpr string

// String returns the CEL expression as a string.
func (e CELExpr) String() string {
    return string(e)
}

// UsernameEquals returns a CEL expression matching a specific username.
func UsernameEquals(username string) CELExpr {
    return CELExpr(fmt.Sprintf(`request.userInfo.username == "%s"`, username))
}

// InGroup returns a CEL expression matching membership in a group.
func InGroup(group string) CELExpr {
    return CELExpr(fmt.Sprintf(`"%s" in request.userInfo.groups`, group))
}

// NamespaceStartsWith returns a CEL expression matching a namespace prefix.
func NamespaceStartsWith(prefix string) CELExpr {
    return CELExpr(fmt.Sprintf(`request.namespace.startsWith("%s")`, prefix))
}

// Or joins expressions with ||.
func Or(exprs ...CELExpr) CELExpr {
    parts := make([]string, len(exprs))
    for i, e := range exprs {
        parts[i] = string(e)
    }
    return CELExpr(strings.Join(parts, " || "))
}

// Not negates an expression.
func Not(expr CELExpr) CELExpr {
    return CELExpr(fmt.Sprintf("!(%s)", expr))
}

func (g *SvcAccountsAndTokenRequestsVAPGenerator) Policies() []*admissionregistrationv1.ValidatingAdmissionPolicy {
    // Namespace condition
    var nsClauses []CELExpr
    for _, prefix := range g.ReservedNamespacePrefixes {
        nsClauses = append(nsClauses, NamespaceStartsWith(prefix))
    }

    // User exemptions
    var exemptions []CELExpr
    for _, u := range g.WhitelistedUsernames {
        exemptions = append(exemptions, UsernameEquals(u))
    }
    for _, grp := range g.WhitelistedUserGroups {
        exemptions = append(exemptions, InGroup(grp))
    }
    exemptions = append(exemptions,
        UsernameEquals(kubeSchedulerUserName),
        UsernameEquals(kubeControllerManagerUserName),
        InGroup(kubeNodeUserGroup),
        InGroup(adminUserGroup),
    )

    // Allow if: not reserved namespace OR user is exempt
    celExpr := Or(Not(Or(nsClauses...)), Or(exemptions...))

    policy := &admissionregistrationv1.ValidatingAdmissionPolicy{
        // ...
        Spec: admissionregistrationv1.ValidatingAdmissionPolicySpec{
            Validations: []admissionregistrationv1.Validation{
                {
                    Expression: celExpr.String(),
                    Message:    "writing service accounts in reserved namespaces or requesting tokens from such service accounts is disallowed",
                    Reason:     ptr.To(metav1.StatusReasonForbidden),
                },
            },
        },
    }
    return []*admissionregistrationv1.ValidatingAdmissionPolicy{policy}
}

func (g *PodsAndReplicaSetsVAPGenerator) Policies() []*admissionregistrationv1.ValidatingAdmissionPolicy {
    var nsClauses []CELExpr
    for _, prefix := range g.ReservedNamespacePrefixes {
        nsClauses = append(nsClauses, NamespaceStartsWith(prefix))
    }

    celExpr := Not(Or(nsClauses...))

    policy := &admissionregistrationv1.ValidatingAdmissionPolicy{
        // ...
        Spec: admissionregistrationv1.ValidatingAdmissionPolicySpec{
            Validations: []admissionregistrationv1.Validation{
                {
                    Expression: celExpr.String(),
                    Message:    "creating pods and replicas is disallowed in the fleet hub cluster",
                    Reason:     ptr.To(metav1.StatusReasonForbidden),
                },
            },
        },
    }
    return []*admissionregistrationv1.ValidatingAdmissionPolicy{policy}
}