That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.

### Ambient

To enable ambient, you can use the ambient profile: `--set profile=ambient`.

#### Calico

For Calico, you must also modify the settings to allow source spoofing:

- if deployed by operator,  `kubectl patch felixconfigurations default --type='json' -p='[{"op": "add", "path": "/spec/workloadSourceSpoofing", "value": "Any"}]'`

  case "${KUBERNETES_CNI:-}" in 

    "calico")
      echo "Installing Calico CNI"
      install_calico "" "$(dirname "$CONFIG")"
      ;;

    "")
      # perfectly fine, we accepted the default KinD CNI
      ;;

    *)
      # we don't know what to do but we've got no CNI, return non-zero
      echo "${KUBERNETES_CNI} is not recognized. Supported options are \"calico\" or do not set the variable to use default."

The details for the deployment & installation of this plugin were pretty much lifted directly from the
[Calico CNI plugin](https://github.com/projectcalico/cni-plugin).

Specifically:

- The CNI installation script is containerized and deployed as a daemonset in k8s.  The relevant calico k8s manifests were used as the model for the istio-cni plugin's manifest:

    logLevel: debug

    # Configuration file to insert istio-cni plugin configuration
    # by default this will be the first file found in the cni-conf-dir
    # Example
    # cniConfFileName: 10-calico.conflist

    # CNI bin and conf dir override settings
    # defaults:
    cniBinDir: "" # Auto-detected based on version; defaults to /opt/cni/bin.
    cniConfDir: /etc/cni/net.d
    cniConfFileName: ""

* Updates Calico version to v2.6.7 (Fixed a bug where Felix would crash when parsing a NetworkPolicy with a named port. See https://github.com/projectcalico/calico/releases/tag/v2.6.7) ([#59130](https://github.com/kubernetes/kubernetes/pull/59130), [@caseydavenport](https://github.com/caseydavenport))

ambient, you need to add `--set cni.ambient.enabled=true`. ### Calico For Calico, you must also modify the settings to allow source spoofing: - if deployed by operator, `kubectl patch felixconfigurations default --type='json' -p='[{"op": "add", "path": "/spec/workloadSourceSpoofi", "value": "Any"}]'` - if deployed by manifest, add env `FELIX_WORKLOADSOURCESPOOFI` with value `Any` in `spec.template.spec.containers.env` for daemonset `calico-node`. (This will allow PODs with specified annotation to skip...

labels.search_result_sort_last_modified_asc	=	Dernière modification (croissant)
labels.search_result_sort_last_modified_desc	=	Dernière modification (décroissant)
labels.search_result_sort_click_count_asc	=	Clics (ascendant)
labels.search_result_sort_click_count_desc	=	Clics (descendant)
labels.search_result_sort_favorite_count_asc	=	Favori (croissant)
labels.search_result_sort_favorite_count_desc	=	Favori (décroissant)

- Now click on the new project you just created. The URL should be `https://builds.gradle.org/admin/editProject.html?projectId=Gradle_<MyTestBranch>`.
- Click `Versioned Settings` on the left sidebar.
  - Select `Synchronization enabled` - `use settings from VCS` - `MyNewVcsRoot`(the one you just created) - `Settings format: Kotlin`, then `Apply`.
- At the popup window, click `Import Settings from VCS`. Wait a few seconds. 

}
```

<img src="/img/tutorial/security/image06.png">

If you click the lock icon and logout, and then try the same operation again, you will get an HTTP 401 error of:

```JSON
{
  "detail": "Not authenticated"
}
```

### Inactive user

Now try with an inactive user, authenticate with:

User: `alice`

Password: `secret2`

        "full_name": "John Doe",
        "email": "******@****.***",
        "hashed_password": "fakehashedsecret",
        "disabled": False,
    },
    "alice": {
        "username": "alice",
        "full_name": "Alice Wonderson",
        "email": "alice@example.com",
        "hashed_password": "fakehashedsecret2",
        "disabled": True,
    },
}

app = FastAPI()


def fake_hash_password(password: str):