This means Ztunnel will have multiple distinct certificates at a time, one for each unique identity (service account) running on its node.

When fetching certificates, ztunnel will authenticate to the CA with its own identity, but request the identity of another workload.
Critically, the CA must enforce that the ztunnel has permission to request that identity.

    // names or patterns, but they should be treated as absolute. At the same time, any hostname
    // presented to this method should also be treated as absolute for the purposes of matching
    // to the server certificate.
    //   www.android.com  matches www.android.com
    //   www.android.com  matches www.android.com.
    //   www.android.com. matches www.android.com.

the CL (or ask the author to do so).

At the end of the development cycle, the files will be merged by being
concatenated in sorted order by pathname. Files in the directory matching the
glob "*stdlib/*minor" are treated specially. They should be in subdirectories
corresponding to standard library package paths, and headings for those package
paths will be generated automatically.

		},
		{
			name:   "create key as user set policy to non matching resource want forbidden",
			method: http.MethodPost,
			path:   kmsKeyCreatePath,
			query:  map[string]string{"key-id": "third-new-test-key"},
			asRoot: false,

			policy: `{"Effect": "Allow",
				"Action": ["kms:CreateKey"],
				"Resource": ["arn:minio:kms:::non-matching-key-name"] }`,

			wantStatusCode: http.StatusForbidden,

// returned for the requested path.
//
// FIXME: It currently only lists `minio_` prefixed metrics.
func (h *metricsV3Server) listMetrics(path string) http.Handler {
	// First collect all matching MetricsGroup's
	matchingMG := make(map[collectorPath]*MetricsGroup)
	for _, collPath := range h.metricsData.collectorPaths {
		if collPath.isDescendantOf(path) {
			if v, ok := h.metricsData.mgMap[collPath]; ok {

  // +optional
  optional string path = 1;

  // PathType determines the interpretation of the Path matching. PathType can
  // be one of the following values:
  // * Exact: Matches the URL path exactly.
  // * Prefix: Matches based on a URL path prefix split by '/'. Matching is
  //   done on a path element by element basis. A path element refers is the

}

// MetricSpec specifies how to scale based on a single metric
// (only `type` and one other matching field should be set at once).
message MetricSpec {
  // type is the type of metric source.  It should be one of "ContainerResource", "External",
  // "Object", "Pods" or "Resource", each mapping to a matching field in the object.
  // Note: "ContainerResource" type is available on when the feature-gate

		stmt := gorm.Statement{DB: DB}
		stmt.Parse(&Blog{})
		stmt.Schema.LookUpField("ID").Unique = true
		stmt.Parse(&Tag{})
		stmt.Schema.LookUpField("ID").Unique = true
		// postgers only allow unique constraint matching given keys
	}

	DB.Migrator().DropTable(&Blog{}, &Tag{}, "blog_tags", "locale_blog_tags", "shared_blog_tags")
	if err := DB.AutoMigrate(&Blog{}, &Tag{}); err != nil {
		t.Fatalf("Failed to auto migrate, got error: %v", err)

  // NamespaceSelector decides whether to run the webhook on an object based
  // on whether the namespace for that object matches the selector. If the
  // object itself is a namespace, the matching is performed on
  // object.metadata.labels. If the object is another cluster scoped resource,
  // it never skips the webhook.
  //
  // For example, to run the webhook on any objects whose namespace is not

		}
		f.Write([]byte(text))
		_, err := f.Finish()
		// We should get a no exit code error
		if err == nil || !wantErr.MatchString(err.Error()) {
			t.Errorf("want error matching %s, got %s", wantErr, err)
		}
		// And it should flush all output (even if it looks
		// like we may be getting an exit code)
		if got := out.String(); text != got {
			t.Errorf("want full output %q, got %q", text, got)