that is, if they require configuration of a server process, and
  subsequent testing in-container.

  Since we're only going to concern ourselves with states where localhost is
  still active, we only need to worry about this case when the server container
  is <<not>> installed on localhost. This allows the popular pattern of starting
  a server container in-JVM, running tests against it, and shutting it down.

** SCM mojos

- In ambient mode, the CNI plugin does not configure any networking, but is only responsible for synchronously pushing new pod events back up to an ambient watch server...

   1EDC; 1EDD; Case map
   1EDE; 1EDF; Case map
   1EE0; 1EE1; Case map
   1EE2; 1EE3; Case map
   1EE4; 1EE5; Case map
   1EE6; 1EE7; Case map
   1EE8; 1EE9; Case map
   1EEA; 1EEB; Case map
   1EEC; 1EED; Case map
   1EEE; 1EEF; Case map
   1EF0; 1EF1; Case map
   1EF2; 1EF3; Case map
   1EF4; 1EF5; Case map
   1EF6; 1EF7; Case map
   1EF8; 1EF9; Case map
   1F08; 1F00; Case map
   1F09; 1F01; Case map

## Setting up your development environment

In order to make changes to Gradle, you'll need:

* A [Java Development Kit](http://jdk.java.net/) (JDK) **version 11**. Fixed version is required to use [remote cache](#remote-build-cache). 
* A text editor or IDE. We use and recommend [IntelliJ IDEA CE](http://www.jetbrains.com/idea/).  IntelliJ Ultimate will also work. You'll need IntelliJ 2021.2.2 or newer.

The original destination is then extracted to determined which certificate to use.
SNI is not used because it is illegal to use IPs in SNI, and there is no other existing standard format to represent what we need to.
Additionally, using the redirection mechanism reduces the need for clients to know the destination's ztunnel address.

I'll tell you a bit more about these **concepts** here, and that would hopefully give you the **intuition** you would need to decide how to deploy your API in very different environments, possibly even in **future** ones that don't exist yet.

By considering these concepts, you will be able to **evaluate and design** the best way to deploy **your own APIs**.

For instance, given that TLS is enabled and you need to add trust for MinIO's own CA and for the CA of a Keycloak server, a Kubernetes secret can be created from the certificate files using `kubectl`:

```
kubectl -n minio create secret generic minio-trusted-certs --from-file=public.crt --from-file=keycloak.crt
```

If TLS is not enabled, you would need only the third party CA:

```

### Certificate Directory

TLS certificates by default are expected to be stored under ``${HOME}/.minio/certs`` directory. You need to place certificates here to enable `HTTPS` based access. Read more about [How to secure access to MinIO server with TLS](https://min.io/docs/minio/linux/operations/network-encryption.html).

   *
   * @param domain A canonicalized domain. An International Domain Name (IDN) should be punycode
   *     encoded.
   */
  fun getEffectiveTldPlusOne(domain: String): String? {
    // We use UTF-8 in the list so we need to convert to Unicode.
    val unicodeDomain = IDN.toUnicode(domain)
    val domainLabels = splitDomain(unicodeDomain)

    val rule = findMatchingRule(domainLabels)

If you want to play with JWT tokens and see how they work, check <a href="https://jwt.io/" class="external-link" target="_blank">https://jwt.io</a>.

## Install `python-jose`

We need to install `python-jose` to generate and verify the JWT tokens in Python:

<div class="termy">

```console
$ pip install "python-jose[cryptography]"

---> 100%
```

</div>