@Override
    public void validate(Context context) {
        if (!context.deployState().isHostedTenantApplication(context.model().getAdmin().getApplicationType())) return;

        context.model().getContainerClusters().forEach((__, cluster) -> {
            var http = cluster.getHttp();
            if (http == null) return;
            var illegalConnectors = http.getHttpServer().stream().flatMap(s -> s.getConnectorFactories().stream()
                    .filter(c -> !isAllowedConnector(c)))
                    .map(cf -> "%s@%d".formatted(cf.getName(), cf.getListenPort()))
                    .toList();
            if (illegalConnectors.isEmpty()) return;
            context.illegal(
                    ("Adding additional or modifying existing HTTPS connectors is not allowed for Vespa Cloud applications." +
                            " Violating connectors: %s. See https://docs.vespa.ai/en/cloud/security/whitepaper.html, " +
                            "https://docs.vespa.ai/en/cloud/security/guide.html#data-plane.")
                            .formatted(illegalConnectors));
        });
    }
Enforces that Cloud applications cannot
1) override connector specific TLS configuration
2) add additional HTTP connectors

@author bjorncs
config-model/src/main/java/com/yahoo/vespa/model/application/validation/CloudHttpConnectorValidator.java