namespace.ClaimOrFail(t, t, istioCfg.SystemNamespace)

			from := apps.EchoNamespace.A
			to := apps.EchoNamespace.B
			fromAndTo := from.Append(to)

			echotest.New(t, fromAndTo).
				WithDefaultFilters(1, 1).
				FromMatch(match.ServiceName(from.NamespacedName())).
				ToMatch(match.ServiceName(to.NamespacedName())).
				Run(func(t framework.TestContext, from echo.Instance, to echo.Target) {

			if err != nil {
				t.Errorf("failed to get workload cert last update time: %v", err)
			}

			// Verify traffic works between a and b
			echotest.New(t, fromAndTo).
				WithDefaultFilters(1, 1).
				FromMatch(match.ServiceName(from.NamespacedName())).
				ToMatch(match.ServiceName(to.NamespacedName())).
				Run(func(t framework.TestContext, from echo.Instance, to echo.Target) {

//	  ConditionallyTo(echotest.ReachableDestinations).
//	  Run()
func (t *T) ConditionallyTo(filters ...CombinationFilter) *T {
	t.destinationFilters = append(t.destinationFilters, filters...)
	return t
}

// WithDefaultFilters applies common filters that work for most tests.
// Example:
//   - The full set of apps is a, b, c, d, e, headless, naked, and vm (one simple pod).

			expect map[string]map[string]int
		}{
			"Run_WithDefaultFilters": {
				run: func(t framework.TestContext, testTopology map[string]map[string]int) {
					echotest.New(t, all).
						WithDefaultFilters(1, 1).
						Run(func(ctx framework.TestContext, from echo.Instance, to echo.Target) {
							// TODO if the destinations would change based on which cluster then add cluster to srCkey

  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
---`)).
						BuildAll(nil, apps.Ns1.All).
						Apply()

					echotest.New(t, apps.Ns1.All.Instances()).
						WithDefaultFilters(1, 1).
						FromMatch(match.NotProxylessGRPC).
						ToMatch(match.And(
							// TODO(nmittler): Why not headless/multiversion?
							match.NotHeadless,
							match.NotMultiVersion,
							match.NotNaked,

func newTrafficTest(t framework.TestContext, echos ...echo.Instances) *echotest.T {
	var all []echo.Instance
	for _, e := range echos {
		all = append(all, e...)
	}

	return echotest.New(t, all).
		WithDefaultFilters(1, 1).
		FromMatch(match.And(
			match.NotNaked,
			match.NotProxylessGRPC)).
		ToMatch(match.And(
			match.NotNaked,
			match.NotProxylessGRPC)).
		ConditionallyTo(echotest.NoSelfCalls)

			}).
			FromMatch(match.And(c.sourceMatchers...)).
			// TODO mainly testing proxyless features as a client for now
			ToMatch(match.And(append(c.targetMatchers, match.NotProxylessGRPC)...)).
			WithDefaultFilters(1, c.toN).
			ConditionallyTo(c.comboFilters...)

		doTest := func(t framework.TestContext, from echo.Caller, to echo.Services) {
			buildOpts := func(options echo.CallOptions) echo.CallOptions {

				}
				return nil
			})),
	}
}

func newTLSGatewayTest(t framework.TestContext) *echotest.T {
	return echotest.New(t, apps.All.Instances()).
		WithDefaultFilters(1, 1).
		FromMatch(match.And(
			match.Namespace(apps.Ns1.Namespace),
			match.NotNaked,
			match.NotProxylessGRPC)).
		ToMatch(match.ServiceName(apps.External.All.NamespacedName()))

							// Run the test cases.
							echotest.New(t, allServices.Instances()).
								FromMatch(match.And(c.fromMatch, match.NotProxylessGRPC)).
								ToMatch(match.And(c.toMatch, match.NotProxylessGRPC)).
								WithDefaultFilters(1, 1).
								ConditionallyTo(echotest.NoSelfCalls).
								Run(func(t framework.TestContext, from echo.Instance, to echo.Target) {
									opts := opts.DeepCopy()
									opts.To = to

}

func runForAllClusterCombinations(
	t framework.TestContext,
	fn func(t framework.TestContext, from echo.Instance, to echo.Target),
) {
	t.Helper()
	echotest.New(t, echos.Instances).
		WithDefaultFilters(1, 1).
		FromMatch(serviceA).
		ToMatch(serviceB).
		Run(fn)
}

func newServiceExport(service string, serviceExportGVR schema.GroupVersionResource) *mcsapi.ServiceExport {
	return &mcsapi.ServiceExport{