Authorization: &security.Authorization{
			Name:      implicitWaypointPolicyName(&waypoint),
			Namespace: waypoint.Namespace,
			// note: we don't actually use label selection; the names have an internally well-known format
			// workload generation will append a reference to this
			Scope:  security.Scope_WORKLOAD_SELECTOR,
			Action: security.Action_ALLOW,
			Groups: []*security.Group{{
				Rules: []*security.Rules{
					{

		return lastError
	}
	return nil
}

// CheckClusterHealth returns nil for status Up or error for status Down
func (c *Client) CheckClusterHealth() error {
	_, err := c.getClusterStatus()
	return err
}

// getClusterStatus returns nil for status Up (along with endpoint status response map) or error for status Down
func (c *Client) getClusterStatus() (map[string]*clientv3.StatusResponse, error) {

// of usernames. This is done both to limit the cardinality of the
// authorized_user_requests metric, and to avoid pushing actual usernames in the
// metric.
func compressUsername(username string) string {
	switch {
	// Known internal identities.
	case username == "admin" ||
		username == "client" ||
		username == "kube_proxy" ||
		username == "kubelet" ||
		username == "system:serviceaccount:kube-system:default":
		return username

}

var (
	// AttributesTotal is a measure of the number of known attributes.
	AttributesTotal = monitoring.NewGauge(
		"mixer/config/attributes_total",
		"The number of known attributes in the current config.",
	)

	// HandlersTotal is a measure of the number of known handlers.
	HandlersTotal = monitoring.NewSum(
		"mixer/config/handler_configs_total",
		"The number of known handlers in the current config.",
	)

    }

    def "delegates when work has no source properties"() {
        def delegateResult = Mock(CachingResult)
        knownInputProperties = ImmutableSortedMap.of("known", knownSnapshot)
        knownInputFileProperties = ImmutableSortedMap.of("known-file", knownFileFingerprint)

        when:
        def result = step.execute(work, context)

        then:
        1 * inputFingerprinter.fingerprintInputProperties(

				Match:     "known.default.svc.cluster.local",
				Dest:      "alt-known.default.svc.cluster.local",
			}},
			proxy:     proxy("not-default"),
			routeName: "8080",
			expected: map[string][]string{
				"known.default.svc.cluster.local": {"outbound|8080||alt-known.default.svc.cluster.local"},
			},
			expectedGateway: map[string][]string{

	annotation.GatewayControllerVersion.Name: true,

	// this annotation is added automatically.
	annotation.IoIstioRev.Name: true,

	// TODO below are ambient related annotations that are not yet known to be stable.
	// They are added automatically, and should not be alerted on.
	// Delete these related annotations once they are stable.
	// Ref: https://github.com/istio/api/pull/2695

        }
    });

    public DefaultSeverity(int severity, boolean known) {
        this.severity = severity;
        this.known = known;
    }

    @Override
    public int getSeverity() {
        return severity;
    }

    @Override
    public boolean isKnown() {
        return known;
    }

    public static Severity from(int severity) {

    /**
     * The test project name. Null if not known or not constant for all experiments
     */
    @Nullable
    String getTestProject();

    /**
     * The tasks executed. Null if not known or not constant for all experiments
     */
    @Nullable
    List<String> getTasks();

    /**
     * The clean tasks executed. Null if not known or not constant for all experiments
     */
    @Nullable

name: Root lockdown tests

on:
  pull_request:
    branches:
      - master

# This ensures that previous jobs for the PR are canceled when the PR is
# updated.
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  build:
    name: Go ${{ matrix.go-version }} on ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    strategy:
      matrix: