case "ISTIO_MUTUAL":
				out.Mode = istio.ServerTLSSettings_ISTIO_MUTUAL
				return out, nil
			}
		}
		if len(tls.CertificateRefs) != 1 {
			// This is required in the API, should be rejected in validation
			return out, &ConfigError{Reason: InvalidTLS, Message: "exactly 1 certificateRefs should be present for TLS termination"}
		}
		cred, err := buildSecretReference(ctx, tls.CertificateRefs[0], gw)
		if err != nil {

			if err != nil {
				return nil, err
			}
		}

		if err = storageclass.ValidateParity(commonParityDrives, ep.DrivesPerSet); err != nil {
			return nil, fmt.Errorf("parity validation returned an error: %w <- (%d, %d), for pool(%s)", err, commonParityDrives, ep.DrivesPerSet, humanize.Ordinal(i+1))
		}

		bootstrapTrace("waitForFormatErasure: loading disks", func() {

	// or use different field manager strings for each entry.
	//
	// With a strategic-merge-patch, we can simply send one new entry. The apiserver
	// validation will catch if two goroutines try to do that at the same time and
	// the claim cannot be shared.
	//
	// Note that this also works when the allocation result gets added twice because

In Gradle 9.0, all changes to a configuration after it has been observed will become an error.
After a configuration of any type has been observed, it should be considered immutable.
This validation covers the following properties of a configuration:

* Resolution Strategy
* Dependencies
* Constraints
* Exclude Rules
* Artifacts
* Role (consumable, resolvable, dependency scope)
* Hierarchy (`extendsFrom`)

		tls simulation.TLSMode, validations []simulation.CustomFilterChainValidation,
		mTLSSecretConfigName string,
	) simulation.Call {
		return simulation.Call{
			Protocol:                  protocol,
			Port:                      port,
			CallMode:                  simulation.CallModeInbound,
			TLS:                       tls,
			CustomListenerValidations: validations,