}

	modes := sets.NewString(o.Modes...)
	for _, mode := range o.Modes {
		if !authzmodes.IsValidAuthorizationMode(mode) {
			allErrors = append(allErrors, fmt.Errorf("authorization-mode %q is not a valid mode", mode))
		}
		if mode == authzmodes.ModeABAC && o.PolicyFile == "" {
			allErrors = append(allErrors, fmt.Errorf("authorization-mode ABAC's authorization policy file not passed"))
		}

// Unpacks the given flatbuffer model.
//
// This helper is useful as UnPackTo requires the input to not have any existing
// state so directly calling UnPackTo could lead to memory leaks if the model
// already had some state. Instead, the returned object from here can be used to
// overwrite existing model.
ModelT UnPackFlatBufferModel(const Model& flatbuffer_model) {
  ModelT model;
  flatbuffer_model.UnPackTo(&model);

			modes:                []string{modes.ModeAlwaysAllow, modes.ModeAlwaysDeny, modes.ModeABAC},
			expectErr:            true,
			expectErrorSubString: "authorization-mode ABAC's authorization policy file not passed",
		},
		{
			name:                 "Authorization Policy file cannot be used without ModeABAC",
			modes:                []string{modes.ModeAlwaysAllow, modes.ModeAlwaysDeny},

				}
			},
		},
	}

	proxy := &model.Proxy{
		Type:         model.SidecarProxy,
		Metadata:     &model.NodeMetadata{},
		IstioVersion: &model.IstioVersion{Major: 1, Minor: 5},
	}
	push := model.NewPushContext()
	for _, test := range tests {
		t.Run(test.name, func(t *testing.T) {
			cb := NewClusterBuilder(proxy, &model.PushRequest{Push: push}, model.DisabledCache{})
			opts := &buildClusterOpts{

			istioService.Attributes.ClusterExternalAddresses = &model.AddressMap{}
		}
		istioService.Attributes.ClusterExternalAddresses.AddAddressesFor(clusterID, svc.Spec.ExternalIPs)
	}

	return istioService
}

func ExternalNameEndpoints(svc *model.Service) []*model.IstioEndpoint {
	if svc.Attributes.ExternalName == "" {
		return nil
	}
	out := make([]*model.IstioEndpoint, 0, len(svc.Ports))

	cb := NewClusterBuilder(newSidecarProxy(), nil, model.DisabledCache{})
	mc := newClusterWrapper(&cluster.Cluster{
		Name: "test-cluster",
	})
	cb.setUseDownstreamProtocol(mc)
	return mc
}

func newSidecarProxy() *model.Proxy {
	return &model.Proxy{Type: model.SidecarProxy, Metadata: &model.NodeMetadata{}}
}

func newGatewayProxy() *model.Proxy {

						}),
				},
			},
		},
	}
	push := model.NewPushContext()
	push.JwtKeyResolver = model.NewJwksResolver(
		model.JwtPubKeyEvictionDuration, model.JwtPubKeyRefreshInterval,
		model.JwtPubKeyRefreshIntervalOnFailure, 10*time.Millisecond)

	defer push.JwtKeyResolver.Close()

	push.ServiceIndex.HostnameAndNamespace[host.Name("jwt-token-issuer.mesh")] = map[string]*model.Service{}

	if tp == nil {
		return nil
	}
	var mode *networkingapi.ClientTLSSettings_TLSmode
	if tp.Tls != nil {
		mode = &tp.Tls.Mode
	}
	// if there is a port-level setting matching this cluster
	for _, portSettings := range tp.GetPortLevelSettings() {
		if int(portSettings.GetPort().GetNumber()) == port && portSettings.Tls != nil {
			mode = &portSettings.Tls.Mode
			break
		}
	}
	return mode

Laura Kassovic <******@****.***> 1701107622 -0800

	}

	modes = GetAccessModesFromString("RWO,ROX,RWX")
	if !ContainsAccessMode(modes, v1.ReadWriteOnce) {
		t.Errorf("Expected mode %s, but got %+v", v1.ReadWriteOnce, modes)
	}
	if !ContainsAccessMode(modes, v1.ReadOnlyMany) {
		t.Errorf("Expected mode %s, but got %+v", v1.ReadOnlyMany, modes)
	}
	if !ContainsAccessMode(modes, v1.ReadWriteMany) {