GatewayLabel:   inst.Settings().IngressGatewayIstioLabel,
				})
				credNames = append(credNames, cred)
			}
			SetupConfig(ctx, ns.Get(), tests...)
			return nil
		}).
		To(echotest.SimplePodServiceAndAllSpecial(1)).
		RunFromClusters(func(ctx framework.TestContext, fromCluster cluster.Cluster, to echo.Target) {
			for _, cn := range credNames {
				CreateIngressKubeSecret(ctx, cn, Mtls, IngressCredentialA, false)
			}

						// Verify the call works
						ingressutil.SendRequestOrFail(t, ing, host, credName, ingressutil.TLS, tlsContextA,
							ingressutil.ExpectedResponse{StatusCode: http.StatusOK})

						// Now rotate the key/cert
						ingressutil.RotateSecrets(t, credName, ingressutil.TLS,
							ingressutil.IngressCredentialB, false)

	}
	return isReady, notReady, resourceDebugInfo, nil
}

func waitForCRDs(objects object.K8sObjects, client kube.Client) error {
	var crdNames []string
	for _, o := range object.KindObjects(objects, name.CRDStr) {
		crdNames = append(crdNames, o.Name)
	}
	if len(crdNames) == 0 {
		return nil
	}

func TestSimpleTlsOrigination(t *testing.T) {
	// nolint: staticcheck
	framework.NewTest(t).
		RequiresSingleNetwork(). // https://github.com/istio/istio/issues/37134
		Run(func(t framework.TestContext) {
			var (
				credName        = "tls-credential-cacert"
				fakeCredName    = "fake-tls-credential-cacert"
				credNameMissing = "tls-credential-not-created-cacert"
			)

			credentialA := ingressutil.IngressCredential{