matchLabels:
      app: a
  mtls:
    mode: STRICT
  portLevelMtls:
    9090:
      mode: PERMISSIVE
```

will be translated into this `Authorization`:

```yaml
action: DENY
groups:
- rules:
  - matches:
    - notPrincipals:
      - presence: {}
- rules:
  - matches:
    - notDestinationPorts:
      - 9090
name: converted_peer_authentication_strict-and-permissive-mtls
scope: WORKLOAD_SELECTOR

		t.Fatalf("expected nsenterFunc to be called")
	}
	r := mockIntercept.lastRedirect[len(mockIntercept.lastRedirect)-1]
	if r.excludeInboundPorts != "15020,15021,15090" {
		t.Fatalf("expect excludeInboundPorts is \"15090\", actual %v", r.excludeInboundPorts)
	}
}

func TestCmdAddTwoContainersWithExplictExcludeInboundPort(t *testing.T) {
	pod, ns := buildFakePodAndNSForClient()

      assertThat(expected.message)
        .isEqualTo("Code must be in range [1000,5000): 1")
    }
    data.write("88021388".decodeHex()) // Close with code 5000
    assertFailsWith<ProtocolException> {
      clientReader.processNextFrame()
    }.also { expected ->
      assertThat(expected.message)
        .isEqualTo("Code must be in range [1000,5000): 5000")
    }
  }

  @Test fun closeReservedSetThrows() {

          i++
          keyIndex++
        }
      }
    } while (cursor.next() != -1)
  }

  fun closeCodeExceptionMessage(code: Int): String? {
    return if (code < 1000 || code >= 5000) {
      "Code must be in range [1000,5000): $code"
    } else if (code in 1004..1006 || code in 1015..2999) {
      "Code $code is reserved and may not be used."
    } else {
      null
    }
  }

   0376-0379
   037B-037D
   037F-0383
   038B
   038D
   03A2
   03CF
   03F7-03FF
   0487
   04CF
   04F6-04F7
   04FA-04FF
   0510-0530
   0557-0558
   0560
   0588
   058B-0590
   05A2
   05BA
   05C5-05CF
   05EB-05EF
   05F5-060B
   060D-061A
   061C-061E
   0620
   063B-063F
   0656-065F
   06EE-06EF
   06FF
   070E
   072D-072F
   074B-077F
   07B2-0900

        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'

  /documents/all:
    get:
      tags:
        - search
      summary: Finds all documents by query

    status: str
    title: str


class JsonApiError(BaseModel):
    errors: typing.List[Error]


@app.get(
    "/a",
    status_code=204,
    response_class=JsonApiResponse,
    responses={500: {"description": "Error", "model": JsonApiError}},
)
async def a():
    pass


@app.get("/b", responses={204: {"description": "No Content"}})
async def b():
    pass  # pragma: no cover

        app = FastAPI()

        @app.get("/", responses={"500": {"model": NonPydanticModel}})
        def read_root():
            pass  # pragma: nocover


def test_invalid_response_model_sub_type_in_responses_raises():
    with pytest.raises(FastAPIError):
        app = FastAPI()

        @app.get("/", responses={"500": {"model": List[NonPydanticModel]}})
        def read_root():

CANONICAL_REVISION='latest'
CANONICAL_SERVICE='foo'
ISTIO_INBOUND_PORTS='*'
ISTIO_LOCAL_EXCLUDE_PORTS='22,15090,15021,15020'
ISTIO_METAJSON_LABELS='{"service.istio.io/canonical-name":"foo","service.istio.io/canonical-revision":"latest"}'
ISTIO_META_CLUSTER_ID='Kubernetes'
ISTIO_META_DNS_CAPTURE='true'
ISTIO_META_MESH_ID=''
ISTIO_META_NETWORK=''
ISTIO_META_WORKLOAD_NAME='foo'
ISTIO_NAMESPACE='bar'
ISTIO_SERVICE='foo.bar'
ISTIO_SERVICE_CIDR='*'

def request_validation_exception_handler(request, exception):
    return JSONResponse({"exception": "request-validation"})


def server_error_exception_handler(request, exception):
    return JSONResponse(status_code=500, content={"exception": "server-error"})


app = FastAPI(
    exception_handlers={
        HTTPException: http_exception_handler,
        RequestValidationError: request_validation_exception_handler,