t.ConfigIstio().Eval(apps.Namespace.Name(), map[string]string{
				"Destination": "a",
			}, cfg).ApplyOrFail(t)
			from := apps.B[0]
			to := apps.A

			// First, expect to fail. Subset does not match
			_ = from.CallOrFail(t, echo.CallOptions{
				To: to,
				Port: echo.Port{
					Name: "http",
				},
				Count: 1,
				Check: check.BodyContains("no healthy upstream"),
			})

			lbls := map[string]string{"subset": "my-subset"}

					}
				}
				return nil
			})

			// Check request and responses have no proxy headers
			instance.CallOrFail(t, echo.CallOptions{
				To: apps.Naked,
				Port: echo.Port{
					Name: ports.HTTP.Name,
				},
				Check: check.And(check.OK(), checkNoProxyHeaders),
			})
			apps.Naked[0].CallOrFail(t, echo.CallOptions{
				To: instance,
				Port: echo.Port{
					Name: ports.HTTP.Name,
				},

	From      Caller
	Opts      CallOptions
	Responses echo.Responses
}

type Caller interface {
	// Call from this Instance to a target Instance.
	Call(options CallOptions) (CallResult, error)
	CallOrFail(t test.Failer, options CallOptions) CallResult
}

type Callers []Caller

// Instances returns an Instances if all callers are Instance, otherwise returns nil.
func (c Callers) Instances() Instances {

					opts := echo.CallOptions{
						To: to,
						Port: echo.Port{
							Name: "http",
						},
					}
					opts.Check = check.And(check.OK(), check.ReachedTargetClusters(t))

					from.CallOrFail(t, opts)
				})
		})

						To:    server,
						Count: 1,
						Port: echo.Port{
							Name: portName,
						},
						Check: check.OK(),
					}
					if portName == "tcp" {
						opts.Scheme = scheme.TCP
					}
					client[0].CallOrFail(t, opts)
				})
			}
		})

		HTTP: echo.HTTP{
			Path:   "/path",
			Method: "GET",
		},
		Count: 1,
		Retry: echo.Retry{
			Options: append(defaultOptions, options...),
		},
		Check: checker,
	}

	_ = cltInstance.CallOrFail(ctx, httpOpts)
}

func sendTrafficToHostname(ctx framework.TestContext, checker echo.Checker, hostname string, options ...retry.Option) {
	ctx.Helper()
	if len(GetClientInstances()) == 0 {

									Name: "https",
								},
								Address: to.Config().Service,
								Scheme:  s,
							}
							opts.Check = check.And(check.OK(), check.ReachedTargetClusters(t))

							from.CallOrFail(t, opts)
						})
					}

					client := match.Cluster(cluster).FirstOrFail(t, client)
					cases := []struct {
						from   echo.Instance
						to     echo.Instances
						expect bool
					}{
						{

					WorkloadPort: 8090,
				},
			},
		}).
		BuildOrFail(t)

	return testNs, client, server
}

func RunTrafficTestClientServer(t framework.TestContext, client, server echo.Instance) {
	_ = client.CallOrFail(t, echo.CallOptions{
		To:    server,
		Count: 1,
		Port: echo.Port{
			Name: "http",
		},
		Check: check.OK(),
	})

			t.ConfigIstio().Eval(ns, args, DestinationRuleConfigIstioMutual).ApplyOrFail(t, apply.Wait)

			client := apps.EchoNamespace.A[0]
			server := apps.EchoNamespace.B[0]
			client.CallOrFail(t, echo.CallOptions{
				To: server,
				Port: echo.Port{
					Name: "http",
				},
				Count: 1,
				Check: check.OK(),
			})

			certPEMs := cert.DumpCertFromSidecar(t, client, server, "http")

					check.RequestHeader("X-Forwarded-Client-Cert", ExpectedXfccHeader)),
				Retry: echo.Retry{
					Options: []retry.Option{retry.Delay(5 * time.Second), retry.Timeout(1 * time.Minute)},
				},
			}

			client[0].CallOrFail(t, opts)
		})
}

const (
	DestinationRuleConfigMutual = `
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: server
  namespace: {{.AppNamespace}}
spec: