func TestReachability(t *testing.T) {
	framework.NewTest(t).
		Run(func(t framework.TestContext) {
			istioCfg := istio.DefaultConfigOrFail(t, t)
			namespace.ClaimOrFail(t, t, istioCfg.SystemNamespace)

			from := apps.EchoNamespace.A
			to := apps.EchoNamespace.B
			fromAndTo := from.Append(to)

			echotest.New(t, fromAndTo).

	}

	if s.OperatorOptions, err = parseConfigOptions(operatorOptions); err != nil {
		return Config{}, err
	}

	return s, nil
}

// DefaultConfigOrFail calls DefaultConfig and fails t if an error occurs.
func DefaultConfigOrFail(t test.Failer, ctx resource.Context) Config {
	cfg, err := DefaultConfig(ctx)
	if err != nil {
		t.Fatalf("Get istio config: %v", err)
	}
	return cfg
}

)

func TestIntermediateCertificateRefresh(t *testing.T) {
	framework.NewTest(t).
		Run(func(t framework.TestContext) {
			t.Skip("https://github.com/istio/istio/issues/49648")
			istioCfg := istio.DefaultConfigOrFail(t, t)
			istioCtl := istioctl.NewOrFail(t, t, istioctl.Config{})
			namespace.ClaimOrFail(t, t, istioCfg.SystemNamespace)
			newX509 := getX509FromFile(t, "ca-cert-alt-2.pem")

        PROXY_CONFIG_XDS_AGENT: "true"
`
	cfg.ControlPlaneValues = cfgYaml
}

func TestReachability(t *testing.T) {
	framework.NewTest(t).
		Run(func(t framework.TestContext) {
			istioCfg := istio.DefaultConfigOrFail(t, t)
			istioCtl := istioctl.NewOrFail(t, t, istioctl.Config{})
			namespace.ClaimOrFail(t, t, istioCfg.SystemNamespace)

			from := apps.EchoNamespace.A
			to := apps.EchoNamespace.B

//
// - Secure naming information is respected in the mTLS handshake.
func TestSecureNaming(t *testing.T) {
	framework.NewTest(t).
		Run(func(t framework.TestContext) {
			istioCfg := istio.DefaultConfigOrFail(t, t)

			testNamespace := apps.EchoNamespace.Namespace
			namespace.ClaimOrFail(t, t, istioCfg.SystemNamespace)
			// Check that the CA certificate in the configmap of each namespace is as expected, which

	ingressType CallType, ingressCred IngressCredential, isCompoundAndNotGeneric bool, clusters ...cluster.Cluster,
) {
	t.Helper()

	// Get namespace for ingress gateway pod.
	istioCfg := istio.DefaultConfigOrFail(t, t)
	systemNS := namespace.ClaimOrFail(t, t, istioCfg.SystemNamespace)
	CreateIngressKubeSecretInNamespace(t, credName, ingressType, ingressCred, isCompoundAndNotGeneric, systemNS.Name(), clusters...)
}

	}
	if fakeRootCert {
		rootCertPathToUse = "/etc/certs/custom/fake-root-cert.pem"
	} else {
		rootCertPathToUse = "/etc/certs/custom/root-cert.pem"
	}
	istioCfg := istio.DefaultConfigOrFail(t, t)
	systemNamespace := namespace.ClaimOrFail(t, t, istioCfg.SystemNamespace)
	args := map[string]string{
		"AppNamespace": serviceNamespace.Name(),

	args := map[string]any{
		"to":             to,
		"Mode":           destinationRuleMode,
		"CredentialName": credentialName,
	}

	// Get namespace for gateway pod.
	istioCfg := istio.DefaultConfigOrFail(t, t)
	systemNS := namespace.ClaimOrFail(t, t, istioCfg.SystemNamespace)

	dr := `
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata: