- presence: {}
- rules:
  - matches:
    - notDestinationPorts:
      - 9090
name: converted_peer_authentication_strict-and-permissive-mtls
scope: WORKLOAD_SELECTOR
```

The above policies reject unauthenticated traffic at the ztunnel unless its destination is port 9090. For more complete examples, read through the [test cases](../../pilot/pkg/serviceregistry/kube/controller/ambientindex_test.go) in the `TestRBACConvert` function.

  // Webhooks with side effects MUST implement a reconciliation system, since a request may be
  // rejected by a future step in the admission chain and the side effects therefore need to be undone.
  // Requests with the dryRun attribute will be auto-rejected if they match a webhook with
  // sideEffects == Unknown or Some.
  optional string sideEffects = 6;

   the issue and determines the impact it has.
2. A member of the security team will respond and either confirm or reject the security report.
   If the report is rejected the response explains why.
3. Code is audited to find any potential similar problems.
4. Fixes are prepared for the latest release.

- Fixes an issue cleaning up CertificateSigningRequest objects with an unparseable `status.certificate` field ([#103948](https://github.com/kubernetes/kubernetes/pull/103948), [@liggitt](https://github.com/liggitt)) [SIG Apps and Auth]

// +union
message LimitResponse {
  // `type` is "Queue" or "Reject".
  // "Queue" means that requests that can not be executed upon arrival
  // are held in a queue until they can be executed or a queuing limit
  // is reached.
  // "Reject" means that requests that can not be executed upon arrival
  // are rejected.
  // Required.
  // +unionDiscriminator
  optional string type = 1;

// +union
message LimitResponse {
  // `type` is "Queue" or "Reject".
  // "Queue" means that requests that can not be executed upon arrival
  // are held in a queue until they can be executed or a queuing limit
  // is reached.
  // "Reject" means that requests that can not be executed upon arrival
  // are rejected.
  // Required.
  // +unionDiscriminator
  optional string type = 1;

     *
     * @param projects The projects to create the dependency graph with
     * @throws DuplicateProjectException
     * @throws CycleDetectedException
     */
    public DefaultProjectDependencyGraph(Collection<MavenProject> projects)
            throws CycleDetectedException, DuplicateProjectException {
        this(projects, projects);
    }

    /**

        queue.add(task);
        return;
      }

      oldRunCount = workerRunCount;

      // If the worker is not yet running, the delegate Executor might reject our attempt to start
      // it. To preserve FIFO order and failure atomicity of rejected execution when the same
      // Runnable is executed more than once, allocate a wrapper that we know is safe to remove by
      // object identity.

        queue.add(task);
        return;
      }

      oldRunCount = workerRunCount;

      // If the worker is not yet running, the delegate Executor might reject our attempt to start
      // it. To preserve FIFO order and failure atomicity of rejected execution when the same
      // Runnable is executed more than once, allocate a wrapper that we know is safe to remove by
      // object identity.

    }

    /**
     * Filter out whitelisted projects with a big twist:
     * Assume we have all projects {@code a, b, c} while active are {@code a, c} and relation among all projects
     * is {@code a -> b -> c}. This method handles well the case for transitive list. But, for non-transitive we need
     * to "pull in" transitive dependencies of eliminated projects, as for case above, the properly filtered list would