return;
            } else if (remaining.cardinality() == 1) {
                // If we're down to one candidate and the attribute has a known precedence,
                // we can stop now and choose this candidate as the match.
                return;
            }
        }
        // If the attribute does not have a known precedence, then we cannot stop
        // until we've disambiguated all of the attributes.

*/

package names

// Canonical controller names
//
// NAMING CONVENTIONS
// 1. naming should be consistent across the controllers
// 2. use of shortcuts should be avoided, unless they are well-known non-Kubernetes shortcuts
// 3. Kubernetes' resources should be written together without a hyphen ("-")
//
// CHANGE POLICY
// The controller names should be treated as IDs.

		Authorization: &security.Authorization{
			Name:      implicitWaypointPolicyName(&waypoint),
			Namespace: waypoint.Namespace,
			// note: we don't actually use label selection; the names have an internally well-known format
			// workload generation will append a reference to this
			Scope:  security.Scope_WORKLOAD_SELECTOR,
			Action: security.Action_ALLOW,
			Groups: []*security.Group{{
				Rules: []*security.Rules{
					{

		return lastError
	}
	return nil
}

// CheckClusterHealth returns nil for status Up or error for status Down
func (c *Client) CheckClusterHealth() error {
	_, err := c.getClusterStatus()
	return err
}

// getClusterStatus returns nil for status Up (along with endpoint status response map) or error for status Down
func (c *Client) getClusterStatus() (map[string]*clientv3.StatusResponse, error) {

// of usernames. This is done both to limit the cardinality of the
// authorized_user_requests metric, and to avoid pushing actual usernames in the
// metric.
func compressUsername(username string) string {
	switch {
	// Known internal identities.
	case username == "admin" ||
		username == "client" ||
		username == "kube_proxy" ||
		username == "kubelet" ||
		username == "system:serviceaccount:kube-system:default":
		return username

}

var (
	// AttributesTotal is a measure of the number of known attributes.
	AttributesTotal = monitoring.NewGauge(
		"mixer/config/attributes_total",
		"The number of known attributes in the current config.",
	)

	// HandlersTotal is a measure of the number of known handlers.
	HandlersTotal = monitoring.NewSum(
		"mixer/config/handler_configs_total",
		"The number of known handlers in the current config.",
	)

    }

    def "delegates when work has no source properties"() {
        def delegateResult = Mock(CachingResult)
        knownInputProperties = ImmutableSortedMap.of("known", knownSnapshot)
        knownInputFileProperties = ImmutableSortedMap.of("known-file", knownFileFingerprint)

        when:
        def result = step.execute(work, context)

        then:
        1 * inputFingerprinter.fingerprintInputProperties(

				Match:     "known.default.svc.cluster.local",
				Dest:      "alt-known.default.svc.cluster.local",
			}},
			proxy:     proxy("not-default"),
			routeName: "8080",
			expected: map[string][]string{
				"known.default.svc.cluster.local": {"outbound|8080||alt-known.default.svc.cluster.local"},
			},
			expectedGateway: map[string][]string{

	annotation.GatewayControllerVersion.Name: true,

	// this annotation is added automatically.
	annotation.IoIstioRev.Name: true,

	// TODO below are ambient related annotations that are not yet known to be stable.
	// They are added automatically, and should not be alerted on.
	// Delete these related annotations once they are stable.
	// Ref: https://github.com/istio/api/pull/2695

        }
    });

    public DefaultSeverity(int severity, boolean known) {
        this.severity = severity;
        this.known = known;
    }

    @Override
    public int getSeverity() {
        return severity;
    }

    @Override
    public boolean isKnown() {
        return known;
    }

    public static Severity from(int severity) {