for configType, cases := range mtlsCases {
		t.Run(configType, func(t *testing.T) {
			for name, pa := range cases {
				t.Run(name, func(t *testing.T) {
					cfgs := pa.Configs
					if pa.Config.Name != "" {
						cfgs = append(cfgs, pa.Config)
					}
					env := environment(t, cfgs...)
					var tests []networkFilterCase
					if pa.IsMtlsDisabled {
						tests = noCrossNetwork
					} else {
						tests = networkFiltered

}

// TestPeerAuthenticationWithSidecar tests the PeerAuthentication policy applies correctly to filter chain generated from
// either the service or sidecar resource.
func TestPeerAuthenticationWithSidecar(t *testing.T) {
	pa := `
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
spec:
  selector:
    matchLabels:
      app: foo
  mtls:
    mode: STRICT
  portLevelMtls:

func convertPeerAuthentication(rootNamespace string, cfg *securityclient.PeerAuthentication) *security.Authorization {
	pa := &cfg.Spec

	mode := pa.GetMtls().GetMode()

	scope := security.Scope_WORKLOAD_SELECTOR
	// violates case #1, #2, or #3
	if cfg.Namespace == rootNamespace || pa.Selector == nil || len(pa.PortLevelMtls) == 0 {

	}

	allPAs := append(rootPAList.Items, workloadPAList.Items...)

	var cfgs []*config.Config
	for _, pa := range allPAs {
		pa := pa
		cfg := crdclient.TranslateObject(pa, config.GroupVersionKind(pa.GroupVersionKind()), "")
		cfgs = append(cfgs, &cfg)
	}

	matchedPA := findMatchedConfigs(podsLabels, cfgs)

				pa := podActions{
					SandboxID:          podStatus.SandboxStatuses[0].Id,
					ContainersToKill:   getKillMap(pod, podStatus, []int{}),
					ContainersToStart:  []int{},
					ContainersToUpdate: map[v1.ResourceName][]containerToUpdateInfo{},
				}
				return &pa
			},
		},

        """

        expect:
        2.times {
            succeeds 'a'
            result.assertTasksExecutedInOrder ':a', ':b', ':c'
        }
        2.times {
            fails 'a', '-Pa.broken'
            result.assertTasksExecutedInOrder ':a', ':b', ':c'
        }
        2.times {
            fails 'a', '-Pb.broken'
            result.assertTasksExecutedInOrder ':a', ':b', ':c'
        }

		[]string{fmt.Sprintf("istio-system/%s", staticStrictPolicyName)})

	// Now remove the namespace and global policies along with the pods
	s.pa.Delete("namespace", testNS)
	s.pa.Delete("global", systemNS)
	s.deletePod(t, "pod2")
	s.assertEvent(t, s.podXdsName("pod2"), s.podXdsName("pod1"), xdsConvertedStaticStrict, s.podXdsName("waypoint-ns-pod"), s.podXdsName("waypoint2-sa"))

00000000  14 03 03 00 01 01 17 03  03 00 35 1c 60 8f 01 6b  |..........5.`..k|
00000010  7c e3 d4 28 24 d8 7c 85  7f 63 44 23 97 7c a0 de  ||..($.|..cD#.|..|
00000020  70 61 9e d9 ce 35 d9 3b  81 68 09 12 c1 b9 5e f5  |pa...5.;.h....^.|
00000030  32 23 9b 47 fc be 74 3c  e6 1b 3f cd e8 c1 f1 4f  |2#.G..t<..?....O|
00000040  17 03 03 00 17 1a 16 bc  fe 99 30 d8 97 c1 00 d9  |..........0.....|

00000020  25 6e 17 15 03 03 00 1a  00 00 00 00 00 00 00 02  |%n..............|
00000030  77 fa b6 34 7e 60 77 f9  a5 09 d1 39 b0 1e 66 86  |w..4~`w....9..f.|

// SpillRegisterArgs emits the code to spill register args into whatever
// locations the spill records specify.
func (fi *FuncInfo) SpillRegisterArgs(last *Prog, pa ProgAlloc) *Prog {
	// Spill register args.
	for _, ra := range fi.spills {
		spill := Appendp(last, pa)
		spill.As = ra.Spill
		spill.From.Type = TYPE_REG
		spill.From.Reg = ra.Reg
		spill.To = ra.Addr
		last = spill
	}
	return last
}