token, err := generateJWT(&key, []byte(claims))
	if err != nil {
		t.Fatalf("failed to generate JWT: %v", err)
	}
	// Create an expired JWT token
	expiredStr := strconv.FormatInt(time.Now().Add(-time.Hour).Unix(), 10)

	cert, certErr := util.ParsePemEncodedCertificate(certBytes)
	if certErr != nil {
		return time.Duration(0), certErr
	}
	timeToExpire := cert.NotAfter.Sub(now)
	if timeToExpire < 0 {
		return time.Duration(0), fmt.Errorf("certificate already expired at %s, but now is %s",
			cert.NotAfter, now)
	}

type TestContext interface {
	resource.Context
	test.Failer

	Context() context.Context

	// NewSubTest creates a new sub-test under the current running Test. The lifecycle of a sub-Test is scoped to the
	// parent. Calls to Done() will block until all children are also Done(). When Run, sub-Tests will automatically
	// create their own Golang *testing.T with the name provided.
	//

	out = append(out, t...)
	return out
}

func (t times) asDurationSinceEpoch(epoch time.Time) []time.Duration {
	out := make([]time.Duration, 0, len(t))
	for _, tm := range t {
		out = append(out, tm.Sub(epoch))
	}
	return out

		config:           configAll,
		templateVars: func(src echo.Callers, dest echo.Instances) map[string]any {
			return map[string]any{
				"Headers": []configData{
					{"@request.auth.claims.sub", "regex", "(\\W|^)(sub-1|sub-2)(\\W|$)"},
					{"@request.auth.claims.nested.key1", "regex", "(\\W|^)value[AB](\\W|$)"},
				},
				"SystemNamespace":   t.Istio.Settings().SystemNamespace,

	//  "kubernetes.io/serviceaccount/service-account.name":"example-pod-sa",
	//  "kubernetes.io/serviceaccount/service-account.uid":"ff578a9e-65d3-11e8-aad2-42010a8a001d",
	//  "sub":"system:serviceaccount:default:example-pod-sa"
	//  }

	// An example token review status
	// "status":{
	//   "authenticated":true,
	//   "user":{
	//     "username":"system:serviceaccount:default:example-pod-sa",

			} else if err != nil && tc.expectedErr != nil && err.Error() != tc.expectedErr.Error() {
				t.Errorf("%s: Got error \"%v\", expected error \"%v\"", id, err, tc.expectedErr)
			} else if err == nil && exp.Sub(tc.expectedExp) != time.Duration(0) {
				t.Errorf("%s: Got expiration time: %s, expected expiration time: %s",
					id, exp.String(), tc.expectedExp.String())
			}
		})
	}
}

func TestGetAud(t *testing.T) {

							// sub filter match is supported only for applyTo HTTP_FILTER
							if cp.ApplyTo != networking.EnvoyFilter_HTTP_FILTER {
								errs = validation.AppendValidation(errs, fmt.Errorf("Envoy filter: subfilter match can be used with applyTo HTTP_FILTER only")) // nolint: stylecheck
								continue
							}

//
// Building in this way ends up being roughly 10x faster than docker. Future work to enable
// sha256-simd (https://github.com/google/go-containerregistry/issues/1330) makes this even faster -
// pushing all images drops to sub-second times, with the registry being the bottleneck (which could
// also use sha256-simd possibly).
func RunCrane(ctx context.Context, a Args) error {
	ctx, span := tracing.Start(ctx, "RunCrane")
	defer span.End()

func (s *DiscoveryServer) processDeltaRequest(req *discovery.DeltaDiscoveryRequest, con *Connection) error {
	stype := v3.GetShortType(req.TypeUrl)
	deltaLog.Debugf("ADS:%s: REQ %s resources sub:%d unsub:%d nonce:%s", stype,
		con.ID(), len(req.ResourceNamesSubscribe), len(req.ResourceNamesUnsubscribe), req.ResponseNonce)

	if req.TypeUrl == v3.HealthInfoType {