@Override
    public void getConfig(CloudDataPlaneFilterConfig.Builder builder) {
        if (clientsLegacyMode) {
            builder.legacyMode(true);
        } else {
            var clientsCfg = clients.stream()
                    .filter(c -> !c.certificates().isEmpty())
                    .map(x -> new CloudDataPlaneFilterConfig.Clients.Builder()
                            .id(x.id())
                            .certificates(x.certificates().stream().map(X509CertificateUtils::toPem).toList())
                            .permissions(x.permissions().stream().map(Client.Permission::asString).sorted().toList()))
                    .toList();
            builder.clients(clientsCfg).legacyMode(false);
        }
    }
@Test
    public void it_generates_correct_config() throws IOException {
        Path certFile = securityFolder.resolve("foo.pem");
        Element clusterElem = DomBuilderTest.parse(
                """ 
                        <container version='1.0'>
                          <clients>
                            <client id="foo" permissions="read,write">
                                <certificate file="%s"/>
                            </client>
                          </clients>
                        </container>
                        """
                        .formatted(applicationFolder.toPath().relativize(certFile).toString()));
        X509Certificate certificate = createCertificate(certFile);

        buildModel(clusterElem);

        CloudDataPlaneFilterConfig config = root.getConfig(CloudDataPlaneFilterConfig.class, cloudDataPlaneFilterConfigId);
        assertFalse(config.legacyMode());
        List<CloudDataPlaneFilterConfig.Clients> clients = config.clients();
        assertEquals(1, clients.size());
        CloudDataPlaneFilterConfig.Clients client = clients.get(0);
        assertEquals("foo", client.id());
        assertIterableEquals(List.of("read", "write"), client.permissions());
        assertIterableEquals(List.of(X509CertificateUtils.toPem(certificate)), client.certificates());

        ConnectorConfig connectorConfig = connectorConfig();
        var caCerts = X509CertificateUtils.certificateListFromPem(connectorConfig.ssl().caCertificate());
        assertEquals(1, caCerts.size());
        assertEquals(List.of(certificate), caCerts);
        assertEquals(List.of("foo.bar"), connectorConfig.serverName().known());
        var srvCfg = root.getConfig(ServerConfig.class, "container/http");
        assertEquals("cloud-data-plane-insecure", srvCfg.defaultFilters().get(0).filterId());
        assertEquals(8080, srvCfg.defaultFilters().get(0).localPort());
        assertEquals("cloud-data-plane-secure", srvCfg.defaultFilters().get(1).filterId());
        assertEquals(4443, srvCfg.defaultFilters().get(1).localPort());
    }