@Override
    public void validate(Context context) {
        if (! context.deployState().isHosted()) return;
        if (context.model().getAdmin().getApplicationType() != ApplicationType.DEFAULT) return;

        for (ContainerCluster<?> cluster : context.model().getContainerClusters().values()) {
            if (cluster.getSecretStore().isPresent() && ! hasIdentityProvider(cluster))
                    context.illegal(String.format(
                            "Container cluster '%s' uses a secret store, so an Athenz domain and an Athenz service" +
                            " must be declared in deployment.xml.", cluster.getName()));
        }
    }
@Test
    void app_without_athenz_in_deployment_fails_validation() throws Exception {
        Throwable exception = assertThrows(IllegalArgumentException.class, () -> {

            DeployState deployState = deployState(servicesXml(), deploymentXml(false));
            VespaModel model = new VespaModel(new NullConfigModelRegistry(), deployState);

            ValidationTester.validate(new SecretStoreValidator(), model, deployState);

        });
        assertTrue(exception.getMessage().contains("Container cluster 'default' uses a secret store, so an Athenz domain and" +
                " an Athenz service must be declared in deployment.xml."));

    }