func Message(errorMessage string) Option {
	return func(cfg *config) {
		cfg.error = errorMessage
	}
}

// MaxAttempts allows defining a maximum number of attempts. If unset, only timeout is considered.
func MaxAttempts(attempts int) Option {
	return func(cfg *config) {
		cfg.maxAttempts = attempts
	}
}

// RetriableFunc a function that can be retried.

			t.Fatalf("expected convergence, but test failed: %v", err)
		}
	})

	t.Run("attempts fail", func(t *testing.T) {
		n := 0
		err := UntilSuccess(func() error {
			n++
			return fmt.Errorf("oops")
		}, MaxAttempts(10), Delay(0))
		if err == nil {
			t.Fatalf("expected error")
		}
		if n != 10 {
			t.Fatalf("expected exactly 10 attempts, got %d", n)
		}
	})

	t.Run("attempts success", func(t *testing.T) {
		n := 0

				attempts++
				if attempts > maxAttempts {
					t.Fatalf("should not reach %d attempts", maxAttempts+1)
				}
				return attempts >= maxAttempts, nil
			}); err != nil {
				t.Fatal(err)
			}
			duration := time.Since(start)
			if min := maxAttempts * intervalMin(test.backoff); duration < min {

type Queue struct {
	queue       workqueue.RateLimitingInterface
	initialSync *atomic.Bool
	name        string
	maxAttempts int
	workFn      func(key any) error
	closed      chan struct{}
	log         *istiolog.Scope
}

// WithName sets a name for the queue. This is used for logging
func WithName(name string) func(q *Queue) {

			retry.UntilSuccess(func() error {
				newWorkloadCert := waitForWorkloadCertUpdate(t, ztunnelPod, sa, istioCtl, originalWorkloadSecret)
				return verifyWorkloadCert(t, newWorkloadCert, newX509)
			}, retry.MaxAttempts(2), retry.Timeout(5*time.Minute))
		})
}

func getWorkloadSecret(t framework.TestContext, zPods []v1.Pod, serviceAccount string, ctl istioctl.Instance) (*configdump.CertsDump, v1.Pod, error) {

		var err error
		fw, err = c.NewPortForwarder(pod.Name, pod.Namespace, "", 0, port)
		if err != nil {
			return err
		}
		if err = fw.Start(); err != nil {
			return err
		}
		return nil
	}, retry.MaxAttempts(5), retry.Delay(time.Millisecond*10))
	return fw, err
}

var dumpClient = &http.Client{}

func portForwardRequest(fw kube.PortForwarder, method, path string) ([]byte, error) {