allow := allowValue(expect.mtlsSucceeds)
								if from.Config().IsNaked() {
									allow = allowValue(expect.plaintextSucceeds)
								}

								if allow {
									opts.Check = check.OK()
								} else {
									opts.Check = check.ErrorOrStatus(http.StatusForbidden)
								}

								mtlsString := "mtls"
								if from.Config().IsNaked() {
									mtlsString = "plaintext"
								}

			}
		}
		return false
	}
}

var fromNaked condition = func(from echo.Instance, _ echo.CallOptions) bool {
	return from.Config().IsNaked()
}

var toNaked condition = func(_ echo.Instance, opts echo.CallOptions) bool {
	return opts.To.Config().IsNaked()
}

var toHeadless condition = func(_ echo.Instance, opts echo.CallOptions) bool {
	return opts.To.Config().IsHeadless()
}

		{app: headless1, expect: false},
		{app: naked1, expect: true},
		{app: external1, expect: true},
	}
	for _, tt := range tests {
		t.Run(tt.app.Config().Service, func(t *testing.T) {
			if got := tt.app.Config().IsNaked(); got != tt.expect {
				t.Errorf("got %v expected %v", got, tt.expect)
			}
		})
	}
}

var _ echo.Instance = fakeInstance{}

var NotExternal = Not(External)

// Naked matches instances with any subset marked with SidecarInject equal to false.
var Naked Matcher = func(i echo.Instance) bool {
	return i.Config().IsNaked()
}

// AllNaked matches instances where every subset has SidecarInject set to false.
var AllNaked Matcher = func(i echo.Instance) bool {
	return i.Config().IsAllNaked()
}

	if protectionutil.IsDeletionCandidate(pvc, volumeutil.PVCProtectionFinalizer) {
		// PVC should be deleted. Check if it's used and remove finalizer if
		// it's not.
		isUsed, err := c.isBeingUsed(ctx, pvc)
		if err != nil {
			return err
		}
		if !isUsed {
			return c.removeFinalizer(ctx, pvc)
		}
		logger.V(2).Info("Keeping PVC because it is being used", "PVC", klog.KObj(pvc))
	}

		match.NotWaypoint,
	)
}

// reachableFromNaked filters out all virtual machines and any instance that isn't on the same network
func reachableFromNaked(from echo.Instance) match.Matcher {
	if !from.Config().IsNaked() {
		return match.Any
	}
	return match.And(
		match.Network(from.Config().Cluster.NetworkName()),
		match.NotVM)

			// mtlsOnExpect defines our expectations for when mTLS is expected when its enabled
			mtlsOnExpect := func(from echo.Instance, opts echo.CallOptions) bool {
				if from.Config().IsNaked() || opts.To.Config().IsNaked() {
					// If one of the two endpoints is naked, we don't send mTLS
					return false
				}
				if opts.To.Config().IsHeadless() && opts.To.Instances().Contains(from) {

        for (CustomInjectAnnotationPropertyHandler handler : customAnnotationPropertyHandlers) {
            if (handler.isUsed()) {
                annotationsTriggeringServiceInjection.add(handler.getAnnotation());
            }
        }

        // This is expensive to calculate, so cache the result

                performSelection(resolveState, module);
            }
            if (dependency.isUsed()) {
                // Some corner case result in the edge being removed, in that case it needs to be "removed"
                module.addUnattachedDependency(dependency);
            }
            processed = true;