// Both Gerrit and GitHub expose every CL/PR as a named ref,
	// and we don't want those commits masquerading as being real
	// pseudo-versions in the main repo.
	if r.fetchLevel <= fetchSome && ref != "" && hash != "" && !r.local {
		r.fetchLevel = fetchSome
		var refspec string
		if ref == "HEAD" {
			// Fetch the hash but give it a local name (refs/dummy),
			// because that triggers the fetch behavior of creating any

	AuthzDerivedPolicies := krt.NewCollection(AuthzPolicies, func(ctx krt.HandlerContext, i *securityclient.AuthorizationPolicy) *model.WorkloadAuthorization {
		meshCfg := krt.FetchOne(ctx, MeshConfig.AsCollection())
		pol := convertAuthorizationPolicy(meshCfg.GetRootNamespace(), i)
		if pol == nil {
			return nil
		}
		return &model.WorkloadAuthorization{
			Authorization: pol,

			cms := []*v1.ConfigMap{}
			if features.SharedMeshConfig != "" {
				cms = AppendNonNil(cms, krt.FetchOne(ctx, ConfigMaps,
					krt.FilterObjectName(types.NamespacedName{Name: features.SharedMeshConfig, Namespace: options.SystemNamespace})))
			}
			cms = AppendNonNil(cms, krt.FetchOne(ctx, ConfigMaps,
				krt.FilterObjectName(types.NamespacedName{Name: cmName, Namespace: options.SystemNamespace})))

        }
        return n;
    }


    /**
     * {@inheritDoc}
     *
     * @see jcifs.smb.DirFileEntryEnumIteratorBase#fetchMore()
     */
    @SuppressWarnings ( "resource" )
    @Override
    protected boolean fetchMore () throws CIFSException {
        FileEntry[] results = this.response.getResults();
        SmbTreeHandleImpl th = getTreeHandle();

// limitations under the License.

package krt

import (
	"istio.io/istio/pkg/slices"
)

func FetchOne[T any](ctx HandlerContext, c Collection[T], opts ...FetchOption) *T {
	res := Fetch[T](ctx, c, opts...)
	switch len(res) {
	case 0:
		return nil
	case 1:
		return &res[0]
	default:
		panic("FetchOne found for more than 1 item")
	}
}

    }


    /**
     * {@inheritDoc}
     * 
     * @throws CIFSException
     *
     * @see jcifs.smb.DirFileEntryEnumIteratorBase#fetchMore()
     */
    @Override
    protected boolean fetchMore () throws CIFSException {
        this.nextRequest.reset(this.response.getResumeKey(), this.response.getLastName());
        this.response.reset();
        try {

		// goes from having a waypoint to having no waypoint and then eventually gets a waypoint back
		return krt.FetchOne[Waypoint](ctx, Waypoints, krt.FilterKey(wp.ResourceName()))
	}

	// try fetching the namespace-defined waypoint
	namespace := ptr.OrEmpty[*v1.Namespace](krt.FetchOne[*v1.Namespace](ctx, Namespaces, krt.FilterKey(o.Namespace)))

            this.ridx++;
            if ( filter(itm) ) {
                return itm;
            }
        }

        if ( !last && !isDone() ) {
            if ( !fetchMore() ) {
                doClose();
                return null;
            }
            this.ridx = 0;
            return advance(true);
        }
        return null;
    }

) krt.TransformationSingle[*networkingclient.WorkloadEntry, model.WorkloadInfo] {
	return func(ctx krt.HandlerContext, wle *networkingclient.WorkloadEntry) *model.WorkloadInfo {
		meshCfg := krt.FetchOne(ctx, MeshConfig.AsCollection())
		policies := a.buildWorkloadPolicies(ctx, AuthorizationPolicies, PeerAuths, meshCfg, wle.Labels, wle.Namespace)
		var waypoint *Waypoint

	// it means we are ok scheduling pods to it.
	readyCniNodes := krt.NewCollection(readyCniPods, func(ctx krt.HandlerContext, p v1.Pod) *v1.Node {
		pnode := krt.FetchOne(ctx, nodes, krt.FilterKey(p.Spec.NodeName))
		if pnode == nil {
			return nil
		}
		node := *pnode
		if !hasTaint(node) {
			return nil
		}
		return node
	}, krt.WithStop(stop))