type Sources []Source

// WithParams creates a new Sources with the given template parameters.
// See Source.WithParams.
func (s Sources) WithParams(params param.Params) Sources {
	out := make(Sources, 0, len(s))
	for _, src := range s {
		out = append(out, src.WithParams(params))
	}
	return out
}

				out.addYAML(withParams(s, param.Params{
					param.From.String():            from,
					param.To.String():              to,
					param.Namespace.String():       to.Config().Namespace,
					param.SystemNamespace.String(): systemNS,
				}))
			}
		}
	}

	for _, to := range toAll {
		for _, s := range out.needTo {
			out.addYAML(withParams(s, param.Params{

				{
					name: "global mtls strict",
					configs: config.Sources{
						config.File("testdata/reachability/global-peer-authn.yaml.tmpl"),
						config.File("testdata/reachability/global-dr.yaml.tmpl"),
					}.WithParams(param.Params{
						mtlsModeParam:            model.MTLSStrict.String(),
						tlsModeParam:             "ISTIO_MUTUAL",
						param.Namespace.String(): systemNS,
					}),
					fromMatch:          notMigration,

	Params() param.Params

	// WithParams creates a new Source with the given template parameters.
	// If a Source contains params, it will be evaluated as a template by GetYAML.
	// If this source already has parameters, the returned Source will contain
	// a union of the two sets. If the same entry appears in the existing params,
	// the new value overwrites the existing.
	WithParams(params param.Params) Source

			crd.DeployGatewayAPIOrSkip(t)
			config.New(t).
				Source(config.File("testdata/requestauthn/gateway-api.yaml.tmpl").WithParams(param.Params{
					param.Namespace.String(): apps.Namespace,
				})).
				Source(config.File("testdata/requestauthn/gateway-jwt.yaml.tmpl").WithParams(param.Params{
					param.Namespace.String(): apps.Namespace,
					"Services":               apps.A.Append(apps.B).Services(),
				})).

			config.New(t).
				Source(config.File("testdata/authz/mtls.yaml.tmpl")).
				Source(config.File("testdata/authz/deny-global.yaml.tmpl").WithParams(param.Params{
					param.Namespace.String(): istio.ClaimSystemNamespaceOrFail(t, t),
				})).
				Source(config.File("testdata/authz/deny-principal.yaml.tmpl").WithParams(
					param.Params{
						"Denied": denied,
					})).
				BuildAll(nil, to).
				Apply()

				Source(config.File("testdata/requestauthn/global-jwt.yaml.tmpl").WithParams(param.Params{
					param.Namespace.String(): istio.ClaimSystemNamespaceOrFail(t, t),
					"Services":               apps.Ns1.All,
					"GatewayIstioLabel":      i.Settings().IngressGatewayIstioLabel,
				})).
				Source(config.File("testdata/requestauthn/ingress.yaml.tmpl").WithParams(param.Params{
					param.Namespace.String(): apps.Ns1.Namespace,

  endpoints:
  # we send directly to a Pod IP here. This is essentially headless
  - address: {{.IngressIp}} # TODO won't work with DNS resolution tests
    ports:
      http: {{.IngressHttpPort}}`).
				WithParams(param.Params{}.SetWellKnown(param.Namespace, apps.Namespace))

			ips, ports := istio.DefaultIngressOrFail(t, t).HTTPAddresses()
			for _, tc := range testCases {
				tc := tc
				for i, ip := range ips {

				t.NewSubTest(tc.name).Run(func(t framework.TestContext) {
					// Create the PeerAuthentication for the test case.
					config.New(t).
						// Add any test-specific configuration.
						Source(config.YAML(tc.config).WithParams(param.Params{
							param.Namespace.String(): apps.Ns1.Namespace,
						})).
						// It's not trivial to force mTLS to pass-through ports. To work around this, we will
						// set up a SE and DR that forces it.