protocol: TCP
    targetPort: 15014
`).ApplyOrFail(t)
			// Apply bad config (referencing invalid host)
			t.ConfigIstio().YAML(ns.Name(), `
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: reviews
spec:
  gateways: [missing-gw]
  hosts:
  - reviews
  http:
  - route:
    - destination: 
        host: reviews
`).ApplyOrFail(t)
			// Status should report error

			runAccessLogFilterTests(t, true)
		})
}

func TestAccessLogsMode(t *testing.T) {
	framework.NewTest(t).
		Run(func(t framework.TestContext) {
			t.NewSubTest("client").Run(func(t framework.TestContext) {
				t.ConfigIstio().File(apps.Namespace.Name(), "./testdata/accesslog/mode-client.yaml").ApplyOrFail(t)
				runAccessLogModeTests(t, true, false)
			})

      imagePullSecrets:
      - name: {{ .imagePullSecret }}
      {{- end }}
      containers:
      - name: istio-proxy
        image: auto
        imagePullPolicy: {{ .imagePullPolicy }}
---
`).ApplyOrFail(t, apply.NoCleanup)
			cs := t.Clusters().Default().(*kubecluster.Cluster)
			retry.UntilSuccessOrFail(t, func() error {
				_, err := kubetest.CheckPodsAreReady(kubetest.NewPodFetch(cs, gatewayNs.Name(), "istio=ingressgateway"))

			ns := apps.EchoNamespace.Namespace.Name()
			args := map[string]string{"AppNamespace": ns}
			t.ConfigIstio().Eval(ns, args, PeerAuthenticationConfig).ApplyOrFail(t, apply.Wait)
			t.ConfigIstio().Eval(ns, args, DestinationRuleConfigIstioMutual).ApplyOrFail(t, apply.Wait)

			client := apps.EchoNamespace.A[0]
			server := apps.EchoNamespace.B[0]
			client.CallOrFail(t, echo.CallOptions{
				To: server,
				Port: echo.Port{

				}
				ctx.ConfigIstio().EvalFile(externalNs, templateParams, tunnelingDestinationRuleFile).ApplyOrFail(ctx)

				for _, tc := range testCases {
					for _, file := range listFilesInDirectory(ctx, tc.configDir) {
						ctx.ConfigIstio().EvalFile(meshNs, templateParams, file).ApplyOrFail(ctx)
					}

					for _, spec := range requestsSpec {
						testName := fmt.Sprintf("%s/%s/%s/%s-request",

				cfg.
					YAML(i.Settings().SystemNamespace, fmt.Sprintf(gwTmpl, network, network, gatewayAddresses[network].ip))
			}
			cfg.ApplyOrFail(t)

			// create a unique SE per cluster
			for _, c := range t.Clusters().Configs() {
				t.ConfigKube(c).YAML(apps.Namespace.Name(), fmt.Sprintf(seTmpl, c.Name())).ApplyOrFail(t)
			}

			weTmpl := `
apiVersion: networking.istio.io/v1alpha3
kind: WorkloadEntry
metadata:

			t.ConfigIstio().File(apps.Namespace.Name(), filepath.Join(base, "istio-mtls-dest-rule.yaml")).ApplyOrFail(t)
			t.ConfigIstio().File(apps.Namespace.Name(), filepath.Join(base, "istio-mtls-gateway.yaml")).ApplyOrFail(t)
			t.ConfigIstio().File(apps.Namespace.Name(), filepath.Join(base, "istio-mtls-vs.yaml")).ApplyOrFail(t)

			// The main SE is available only to app namespace, make one the egress can access.

        grpc_response_status: 
          value: istio_grpcResponseStatus
        custom_dimension: 
          value: "'test'"
        source_principal:
          operation: REMOVE

`).ApplyOrFail(t)
			t.Cleanup(func() {
				if t.Failed() {
					util.PromDump(t.Clusters().Default(), promInst, prometheus.Query{Metric: "istio_requests_total"})
				}
			})

        subset: {{ .Config.Cluster.Name }}
{{- end }}
`, map[string]any{"src": sources, "dst": to, "host": to.Config().ClusterLocalFQDN()})
						t.ConfigIstio().YAML(sources.Config().Namespace.Name(), cfg).ApplyOrFail(t)
					},
				},
			}

			for _, test := range tests {
				test := test
				t.NewSubTest(test.name).Run(func(t framework.TestContext) {
					test.setup(t)
					for _, source := range sources {

    tls:
      mode: MUTUAL
      clientCertificate: /etc/certs/custom/cert-chain.pem
      privateKey: /etc/certs/custom/key.pem
      caCertificates: /etc/certs/custom/root-cert.pem
      sni: server
`).ApplyOrFail(t)

			for _, portName := range []string{"grpc", "http", "tcp"} {
				portName := portName
				t.NewSubTest(portName).Run(func(t framework.TestContext) {
					opts := echo.CallOptions{
						To:    server,