Cert: trustDomains[td].cert,
										Key:  trustDomains[td].key,
									},
									Check: check.OK(),
								}
							}
							if !allow {
								opt.Check = check.ErrorContains("tls: unknown certificate")
							}
							from.CallOrFail(t, opt)
						})
					}

					// Request using plaintext should always allowed.

	testUserNsPodsManager := &failingUserNsPodsManager{}
	_, err := MakeUserNsManager(testUserNsPodsManager)
	assert.Error(t, err)
	assert.ErrorContains(t, err, "read pods from disk")
}

func TestRecordBounds(t *testing.T) {
	featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, pkgfeatures.UserNamespacesSupport, true)

	const errorContains = "use ParsePKIXPublicKey instead"
	derBytes, _ := hex.DecodeString(pkixPublicKey)
	_, err := ParsePKCS1PublicKey(derBytes)
	if !strings.Contains(err.Error(), errorContains) {
		t.Errorf("expected error containing %q, got %s", errorContains, err)
	}
}

func TestMarshalInvalidPublicKey(t *testing.T) {

	for _, tc := range testCases {
		t.Run(tc.name, func(t *testing.T) {
			rnr, err := newInternal(tc.handler)
			assert.NoError(t, err)

			err = rnr.Add(tc.counterName)
			if tc.err != nil {
				assert.ErrorContains(t, err, tc.err.Error())
			} else {
				assert.NoError(t, err)
			}

			// validate number of requests
			assert.Equal(t, tc.netlinkCalls, len(tc.handler.requests))

			if tc.netlinkCalls > 0 {

        host: "{{.Destination}}"
`).ApplyOrFail(t)
		src.CallOrFail(t, opt)
	})
}

var CheckDeny = check.Or(
	check.ErrorContains("rpc error: code = PermissionDenied"), // gRPC
	check.ErrorContains("EOF"),                                // TCP envoy
	check.ErrorContains("read: connection reset by peer"),     // TCP ztunnel
	check.NoErrorAndStatus(http.StatusForbidden),              // HTTP

		t.Logf("resolveRecursiveReadOnly(%+v, %v) = (%v, %v)", tc.m, tc.runtimeSupportsRRO, got, err)
		if tc.expectedErr == "" {
			assert.Equal(t, tc.expected, got)
			assert.NoError(t, err)
		} else {
			assert.ErrorContains(t, err, tc.expectedErr)
		}
	}