}
	if err := ValidatePort(int(config.Port)); err != nil {
		errs = AppendErrors(errs, err)
	}
	if err := validateExtensionProviderService(config.Service); err != nil {
		errs = AppendErrors(errs, err)
	}
	if err := validateExtensionProviderEnvoyExtAuthzStatusOnError(config.StatusOnError); err != nil {
		errs = AppendErrors(errs, err)
	}
	if config.PathPrefix != "" {

		errs = AppendErrors(errs, fmt.Errorf("short names (non FQDN) are not allowed"))
	}

	if err := ValidateWildcardDomain(hostname); err != nil {
		if !isGateway {
			errs = AppendErrors(errs, err)
		}

		// Gateway allows IP as the host string, as well
		if !netutil.IsValidIPAddress(hostname) {
			errs = AppendErrors(errs, err)
		}
	}
	// partial wildcard is not allowed

			name := policyName(policy.Namespace, policy.Name, i, b.option)
			if rule == nil {
				b.logger.AppendError(fmt.Errorf("skipped nil rule %s", name))
				continue
			}
			m, err := authzmodel.New(rule, b.option.UseExtendedJwt)
			if err != nil {
				b.logger.AppendError(multierror.Prefix(err, fmt.Sprintf("skipped invalid rule %s:", name)))
				continue
			}
			m.MigrateTrustDomain(b.trustDomainBundle)

				return false
			}
			if a.Key != "" {
				s.closeGroup(a.Key)
			}
		}
	} else {
		s.appendKey(a.Key)
		s.appendValue(a.Value)
	}
	return true
}

func (s *handleState) appendError(err error) {
	s.appendString(fmt.Sprintf("!ERROR:%v", err))
}

func (s *handleState) appendKey(key string) {
	s.buf.WriteString(s.sep)
	if s.prefix != nil && len(*s.prefix) > 0 {