// the workload ports are working correctly.
				{
					name: "DISABLE",
					config: `apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: mtls
spec:
  mtls:
    mode: DISABLE`,
					expected: []expect{
						{
							port:              ports.TCPWorkloadOnly,
							plaintextSucceeds: true,

				apiv1.SchemeGroupVersion.WithResource("pods"):                       false,
			},
			err: false, // no error for backwards compatibility
		},
		{
			name: "user-explicit-disable-resource-over-user-version-enable-over-user-stability-disable",
			runtimeConfig: map[string]string{
				"api/ga":              "false",
				"apps/v1":             "true",
				"apps/v1/deployments": "false",
			},

		switch msgp.UnsafeString(field) {
		case "Disable":
			if dc.IsNil() {
				err = dc.ReadNil()
				if err != nil {
					err = msgp.WrapError(err, "Disable")
					return
				}
				z.Disable = nil
			} else {
				if z.Disable == nil {
					z.Disable = new(bool)
				}
				*z.Disable, err = dc.ReadBool()
				if err != nil {
					err = msgp.WrapError(err, "Disable")
					return
				}
			}

fi

# This variable is unused in this file, but not in those that source it.
# shellcheck disable=SC2034
ADDON_CHECK_INTERVAL_SEC=${TEST_ADDON_CHECK_INTERVAL_SEC:-60}
ADDON_PATH=${ADDON_PATH:-/etc/kubernetes/addons}

# This variable is unused in this file, but not in those that source it.
# shellcheck disable=SC2034
SYSTEM_NAMESPACE=kube-system

# Addons could use this label with two modes:

# limitations under the License.

# shellcheck disable=SC2034 # Variables sourced in other scripts.

# A set of helpers for tests

reset=$(tput sgr0)
bold=$(tput bold)
black=$(tput setaf 0)
red=$(tput setaf 1)
green=$(tput setaf 2)
readonly reset bold black red green

kube::test::clear_all() {
  if kube::test::if_supports_resource "rc" ; then
    # shellcheck disable=SC2154

      - prefix(istio.io/) # Groups all imports with the specified Prefix.
  gocritic:
    # Disable all checks.
    # Default: false
    disable-all: true
    # Which checks should be enabled in addition to default checks. Since we don't want
    # all of the default checks, we do the disable-all first.
    enabled-checks:
      - appendCombine
      - argOrder
      - assignOp
      - badCond

=== Disable for a build

To disable the Daemon for a single build, pass the `--no-daemon` flag when you run a build:

----
$ gradle <task> --no-daemon
----

This flag overrides any settings that enable the Daemon in your project including the `gradle.properties` files.

=== Disable for a project

					},
				},
			},
		},
		{
			name: "disable-accesslog",
			push: env.PushContext(),
			proxy: &model.Proxy{
				ConfigNamespace: "default",
				Labels:          map[string]string{"app": "test-disable-accesslog"},
				Metadata:        &model.NodeMetadata{Labels: map[string]string{"app": "test-disable-accesslog"}},
			},
			tcp:      &tcp.TcpProxy{},

   matchLabels:
     app: foo
 mtls:
   mode: STRICT
 portLevelMtls:
   9000:
     mode: DISABLE
---`
	paDisableWithStrictOnPort9000 := `
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
 name: default
spec:
 selector:
   matchLabels:
     app: foo
 mtls:
   mode: DISABLE
 portLevelMtls:
   9000:
     mode: STRICT
---`
	paDisableWithPermissiveOnPort9000 := `

				t.Error(err)
			}
			responses.Done()
		}()
	}
	// We wait for all calls to be received by the server
	calls.Wait()
	// Disable calls notifications in the server
	// Disable calls notifications in the server
	waitForCallsMutex.Lock()
	waitForCalls = false
	waitForCallsMutex.Unlock()

	// Do this multiple times to show that rate limit rejected requests don't block.