}
						t.NewSubTestf("%s%s", schemeStr, opts.HTTP.Path).Run(func(t framework.TestContext) {
							// Run the test cases.
							echotest.New(t, allServices.Instances()).
								FromMatch(match.And(c.fromMatch, match.NotProxylessGRPC)).
								ToMatch(match.And(c.toMatch, match.NotProxylessGRPC)).
								WithDefaultFilters(1, 1).
								ConditionallyTo(echotest.NoSelfCalls).

  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
---`)).
						BuildAll(nil, apps.Ns1.All).
						Apply()

					echotest.New(t, apps.Ns1.All.Instances()).
						WithDefaultFilters(1, 1).
						FromMatch(match.NotProxylessGRPC).
						ToMatch(match.And(
							// TODO(nmittler): Why not headless/multiversion?
							match.NotHeadless,
							match.NotMultiVersion,
							match.NotNaked,

					},
				},
			},
			"RunToN": {
				run: func(t framework.TestContext, testTopology map[string]map[string]int) {
					echotest.New(t, all).
						WithDefaultFilters(1, 1).
						FromMatch(match.And(match.NotNaked, match.NotHeadless)).
						ToMatch(match.NotHeadless).
						RunToN(3, func(ctx framework.TestContext, from echo.Instance, dsts echo.Services) {
							srcKey := from.Config().ClusterLocalFQDN()

				// we only apply to config clusters
				scope := t.ConfigIstio()
				if c.globalConfig {
					scope = t.ConfigKube()
				}
				return scope.YAML("", cfg).Apply()
			}).
			FromMatch(match.And(c.sourceMatchers...)).
			// TODO mainly testing proxyless features as a client for now
			ToMatch(match.And(append(c.targetMatchers, match.NotProxylessGRPC)...)).
			WithDefaultFilters(1, c.toN).

				}
				return nil
			})),
	}
}

func newTLSGatewayTest(t framework.TestContext) *echotest.T {
	return echotest.New(t, apps.All.Instances()).
		WithDefaultFilters(1, 1).
		FromMatch(match.And(
			match.Namespace(apps.Ns1.Namespace),
			match.NotNaked,
			match.NotProxylessGRPC)).
		ToMatch(match.ServiceName(apps.External.All.NamespacedName()))

func runForAllClusterCombinations(
	t framework.TestContext,
	fn func(t framework.TestContext, from echo.Instance, to echo.Target),
) {
	t.Helper()
	echotest.New(t, echos.Instances).
		WithDefaultFilters(1, 1).
		FromMatch(serviceA).
		ToMatch(serviceB).
		Run(fn)
}

func newServiceExport(service string, serviceExportGVR schema.GroupVersionResource) *mcsapi.ServiceExport {
	return &mcsapi.ServiceExport{