{filter: "-postsubmit,-customsetup", labels: NewSet(), expected: true},
		{filter: "-postsubmit,customsetup", labels: NewSet(Postsubmit, CustomSetup), expected: false},
		{filter: "-postsubmit,customsetup", labels: NewSet(CustomSetup), expected: true},
		{filter: "-postsubmit,customsetup", labels: NewSet(Postsubmit), expected: false},
		{filter: "-postsubmit,customsetup", labels: NewSet(), expected: false},

	Postsubmit Instance = "postsubmit"

	// CustomSetup indicates that the test requires a custom Istio installation.
	CustomSetup Instance = "customsetup"

	// IPv4 indicates a test is only compatible with IPv4 clusters.
	// Any usage of this should have an associated GitHub issue to make it compatible with IPv6
	IPv4 Instance = "ipv4"
)

var all = NewSet(
	Postsubmit,
	CustomSetup,
	IPv4)

// Find the label with the given name

```console
$ go test ./... --istio.test.select -customsetup
```

You can "and" the predicates by separating with commas:

```console
$ go test ./... --istio.test.select +customsetup,-postsubmit
```

This will select tests that have ```label.CustomSetup``` only. It will **not** select tests that have both ```label.CustomSetup```
and ```label.Postsubmit```.

### Running Tests on CI

	systemNs  namespace.Instance
)

// remote_jwks is to test fully delegating Envoy to fetch JWKs server (PILOT_JWT_ENABLE_REMOTE_JWKS: envoy).
func TestMain(m *testing.M) {
	framework.
		NewSuite(m).
		Label(label.CustomSetup).
		Setup(istio.Setup(&ist, setupConfig)).
		Setup(func(ctx resource.Context) error {
			var err error
			systemNs, err = istio.ClaimSystemNamespace(ctx)
			return err
		}).

)

var (
	inst istio.Instance
	apps deployment.SingleNamespaceView
)

func TestMain(m *testing.M) {
	framework.
		NewSuite(m).
		// Needed as it requires an environmental variable
		Label(label.CustomSetup).
		Setup(istio.Setup(&inst, setupConfig)).
		Setup(deployment.SetupSingleNamespace(&apps, deployment.Config{})).
		Run()
}

func setupConfig(_ resource.Context, cfg *istio.Config) {
	if cfg == nil {
		return

	authzServer      authz.Server
	localAuthzServer authz.Server
	jwtServer        jwt.Server

	i istio.Instance
)

func TestMain(m *testing.M) {
	framework.
		NewSuite(m).
		Label(label.CustomSetup).
		Setup(istio.Setup(&i, func(c resource.Context, cfg *istio.Config) {
			if !c.Settings().EnableDualStack {
				cfg.ControlPlaneValues = `
values:
  pilot: 
    env: 
      PILOT_JWT_ENABLE_REMOTE_JWKS: true

		runSkipped = ctx.skipped
		return 0
	}

	sel, err := label.ParseSelector("-customsetup")
	g.Expect(err).To(BeNil())
	settings := resource.DefaultSettings()
	settings.Selector = sel

	s := newTestSuite("tid", runFn, defaultExitFn, settingsFn(settings))
	s.Label(label.CustomSetup)
	s.Run()

	g.Expect(runSkipped).To(BeTrue())
}

func TestSuite_Label_SuiteAllow(t *testing.T) {

	"istio.io/istio/pkg/test/framework/label"
	"istio.io/istio/pkg/test/framework/resource"
	"istio.io/istio/tests/integration/telemetry/tracing"
)

func TestMain(m *testing.M) {
	framework.NewSuite(m).
		Label(label.CustomSetup).
		Setup(istio.Setup(tracing.GetIstioInstance(), setupConfig)).
		Setup(tracing.TestSetup).
		Run()
}

func setupConfig(ctx resource.Context, cfg *istio.Config) {
	if cfg == nil {
		return
	}

	apps      deployment.SingleNamespaceView
	jwtServer jwt.Server
	echoNS    namespace.Instance
	systemNs  namespace.Instance
)

func TestMain(m *testing.M) {
	framework.
		NewSuite(m).
		Label(label.CustomSetup).
		Setup(istio.Setup(&ist, setupConfig)).
		Setup(func(ctx resource.Context) error {
			var err error
			systemNs, err = istio.ClaimSystemNamespace(ctx)
			return err
		}).

)

var (
	i     istio.Instance
	echos common.EchoDeployment
)

func TestMain(m *testing.M) {
	// nolint: staticcheck
	framework.
		NewSuite(m).
		Label(label.CustomSetup).
		RequireMultiPrimary().
		RequireMinVersion(17).
		Setup(common.InstallMCSCRDs).
		Setup(istio.Setup(&i, enableMCSAutoExport)).
		Setup(common.DeployEchosFunc("se", &echos)).
		Run()
}