Mode: model.MTLSDisable,
		}
	}
	return b.applier.InboundMTLSSettings(port, b.proxy, b.trustDomains, authn.NoOverride)
}

func (b *Builder) ForHBONE() authn.MTLSSettings {
	if b == nil {
		return authn.MTLSSettings{
			Port: model.HBoneInboundListenPort,
			Mode: model.MTLSDisable,
		}
	}
	// HBONE is always strict
	return b.applier.InboundMTLSSettings(model.HBoneInboundListenPort, b.proxy, b.trustDomains, model.MTLSStrict)

Laura Kassovic <******@****.***> 1701107622 -0800

// for the given service innstance.
func NewPolicyApplier(push *model.PushContext, proxy *model.Proxy, svc *model.Service) PolicyApplier {
	forWorkload := model.PolicyMatcherForProxy(proxy).WithService(svc)
	return newPolicyApplier(
		push.AuthnPolicies.GetRootNamespace(),
		push.AuthnPolicies.GetJwtPoliciesForWorkload(forWorkload),
		push.AuthnPolicies.GetPeerAuthenticationsForWorkload(forWorkload), push)
}

        }
    }

    @Override
    public Model injectDefaultValues(Model model, ModelBuilderRequest request, ModelProblemCollector problems) {
        Model.Builder builder = Model.newBuilder(model);

        builder.dependencies(injectList(model.getDependencies(), this::injectDependency));
        Build build = model.getBuild();
        if (build != null) {

grep 'mode: set' $WORK/covdata/out.txt
grep 'mod.example/main/main.go:' $WORK/covdata/out.txt
grep 'mod.example/sub/sub.go:' $WORK/covdata/out.txt
! grep 'rsc.io' $WORK/covdata/out.txt

rm $WORK/covdata
rm $WORK/modex.exe

#-------------------------------------------

# Repeat the build but with -coverpkg=all

go build -mod=mod -coverpkg=all -o $WORK/modex.exe -cover mod.example/main

# Execute.

    default values when in "declaration" mode but not "definition" mode. A view
    of some argument object simply knows its default value and does not care the
    context.
*   In terms of dependencies, `Renderers` use `Views` and other `Renderers`.
    However, `Renderers` do **not** reference the model directly (e.g.
    `OpSpec`). This is because if a renderer needs to reference part of the
    model, it should get a language specific representation.

var repeatableAuthorizerTypes = []string{modes.ModeWebhook}

// GetNameForAuthorizerMode returns the name to be set for the mode in AuthorizationConfiguration
// For now, lower cases the mode name
func GetNameForAuthorizerMode(mode string) string {
	return strings.ToLower(mode)
}

	// ErrPrimaryKeyRequired primary keys required
	ErrPrimaryKeyRequired = errors.New("primary key required")
	// ErrModelValueRequired model value required
	ErrModelValueRequired = errors.New("model value required")
	// ErrModelAccessibleFieldsRequired model accessible fields required
	ErrModelAccessibleFieldsRequired = errors.New("model accessible fields required")
	// ErrSubQueryRequired sub query required
	ErrSubQueryRequired = errors.New("sub query required")

	// 2) workload instances have the same IP but different networks
	GetByIP(string) []*model.WorkloadInstance
	// Empty returns whether the index is empty.
	Empty() bool
	// ForEach iterates over all workload instances in the index.
	ForEach(func(*model.WorkloadInstance))
}

// indexKey returns index key for a given workload instance.
func indexKey(wi *model.WorkloadInstance) string {

			c.FuzzNoCustom(obj) // fuzz self without calling this function again

			// Custom fuzzing for allocation mode: pick one valid mode randomly.
			modes := []resource.AllocationMode{
				resource.AllocationModeImmediate,
				resource.AllocationModeWaitForFirstConsumer,
			}
			obj.AllocationMode = modes[c.Rand.Intn(len(modes))]
		},
	}