action: DENY
groups:
- rules:
  - matches:
    - destinationPorts:
      - 9090
      notPrincipals:
      - presence: {}
name: converted_peer_authentication_disable-strict-mtls

  TF_ASSERT_OK_AND_ASSIGN(auto stats, profiler->GetCompileStats(function));
  EXPECT_TRUE(stats.is_megamorphic);

  // Always compile for strict compile mode.
  EXPECT_TRUE(
      profiler->ShouldCompileCluster(function, DeviceCompileMode::kStrict, 0));

  // Once a cluster has gone megamorphic, it remains megamorphic (even though
  // it's being executed more frequently now) and shouldn't be compiled again.

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: strict-mtls
spec:
  selector:
    matchLabels:
      app: a
  mtls:
    mode: UNSET
  portLevelMtls:
    8080: 

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: strict-and-disable-mtls
spec:
  selector:
    matchLabels:
      app: a
  mtls:
    mode: STRICT
  portLevelMtls:
    9090:

John Howard <******@****.***> 1709232034 -0800

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: strict-and-permissive-mtls
spec:
  selector:
    matchLabels:
      app: a
  mtls:
    mode: STRICT
  portLevelMtls:
    9090:

    /**
     *
     * @param reader a reader object.
     * @param strict a strict object.
     * @throws IOException IOException if any.
     * @throws XmlPullParserException XmlPullParserException if
     * any.
     * @return Model
     */
    public Model read(Reader reader, boolean strict) throws IOException, XmlPullParserException {
        return read(reader, strict, null);
    } // -- Model read( Reader, boolean )

    /**

import spock.lang.Specification

class NodeStateTest extends Specification {

    int idIdx = 0
    NodeState root = nextNode()

    def "uses empty strict version constraints object if no strict versions are defined"() {
        Set<ModuleIdentifier> constraintsSet = []

        when:
        root.maybeCollectStrictVersions(constraintsSet, edge(root, false).dependencyState)

						{
							MatchType: &security.StringMatch_Presence{},
						},
					},
				},
			},
		})
	}

	// If we have a strict policy and all of the ports are strict, it's effectively a strict policy
	// so we can exit early and have the WorkloadRbac xDS server push its static strict policy.
	// Note that this doesn't actually attach the policy to any workload; it just makes it available
	// to ztunnel in case a workload needs it.

  limit: Int = length,
  encodeSet: String,
  alreadyEncoded: Boolean = false,
  strict: Boolean = false,
  plusIsSpace: Boolean = false,
  unicodeAllowed: Boolean = false,
): String {
  return canonicalizeWithCharset(
    pos = pos,
    limit = limit,
    encodeSet = encodeSet,
    alreadyEncoded = alreadyEncoded,
    strict = strict,
    plusIsSpace = plusIsSpace,
    unicodeAllowed = unicodeAllowed,
  )
}