}
			err := cw.PrintBootstrapDump("json")
			if tt.wantOutputFile != "" {
				util.CompareContent(t, gotOut.Bytes(), tt.wantOutputFile)
			}
			if err == nil && tt.wantErr {
				t.Errorf("PrintBootstrapDump (%v) did not produce expected err", tt.name)
			} else if err != nil && !tt.wantErr {
				t.Errorf("PrintBootstrapDump (%v) produced unexpected err: %v", tt.name, err)
			}
		})
	}
}

			if tt.callPrime {
				cw.Prime(cd)
			}
			if tt.wantOutputSecret != "" {
				err := cw.PrintSecretSummary()
				if err == nil && tt.wantErr {
					t.Errorf("PrintSecretSummary (%v) did not produce expected err", tt.name)
				} else if err != nil && !tt.wantErr {
					t.Errorf("PrintSecretSummary (%v) produced unexpected err: %v", tt.name, err)
				}

				K8sServicePort:     c.k8sServicePort,
				SkipTLSVerify:      c.skipTLSVerify,
			}
			result, err := createKubeConfig(cfg)
			if err != nil {
				if !c.expectedFailure {
					t.Fatalf("did not expect failure: %v", err)
				}
				// Successful test case expecting failure
				return
			} else if c.expectedFailure {
				t.Fatalf("expected failure")
			}

			goldenFilepath := "testdata/kubeconfig-tls"

	matched, err := regexp.MatchString(validationPattern, slp)
	if err != nil {
		return nil, err
	}
	if !matched {
		return nil, fmt.Errorf("pattern %s did not match", slp)
	}
	scopeLogLevel := strings.Split(slp, ":")
	s := &ScopeLevelPair{
		scope:    scopeLogLevel[0],
		logLevel: scopeLogLevel[1],
	}
	return s, nil
}

message AdmissionRequest {
  // UID is an identifier for the individual request/response. It allows us to distinguish instances of requests which are
  // otherwise identical (parallel requests, requests when earlier requests did not modify etc)
  // The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request.

					t.Fatal(err)
				}
			}

			select {
			case err := <-errChan:
				if err != nil {
					// An invalid configuration should return nil
					// Either an invalid config did not return nil (which is an issue) or an unexpected error occurred
					t.Fatal(err)
				}
				assert.Equal(t, isReady.Load(), false)
			case <-time.After(5 * time.Second):

				tc.numWebhooks, len(wh.Webhooks))
		}
		tag, exists := wh.ObjectMeta.Labels[IstioTagLabel]
		if !exists {
			t.Errorf("expected tag webhook to have %s label, did not find", IstioTagLabel)
		}
		if tag != tc.tagName {
			t.Errorf("expected tag webhook to have istio.io/tag=%s, found %s instead", tc.tagName, tag)
		}

		// ensure all webhooks have the correct client config

func checkOutput(t *testing.T, output string, expected, unexpected []string) {
	t.Helper()
	for _, expected := range expected {
		if !strings.Contains(output, expected) {
			t.Errorf("expected %s included in writer output, did not find", expected)
		}
	}
	for _, unexpected := range unexpected {
		if strings.Contains(output, unexpected) {
			t.Errorf("unexpected string %s included in writer output", unexpected)
		}
	}

		retry.UntilSuccessOrFail(t, func() error {
			if err := checkResult(resultFile, expectedOutputFile); err == nil {
				// We should have waited for the delayed conf
				return fmt.Errorf("did not wait for valid config file")
			}
			return nil
		}, retry.Delay(time.Millisecond), retry.Timeout(time.Millisecond*250))
		var destFilenm string
		if preConfFile != "" {
			destFilenm = preConfFile
		} else {

	// Create a kube client
	client := kube.NewFakeClient(objects...)

	mockRedir := &mockInterceptRuleMgr{}
	err = doAddRun(args, conf, client.Kube(), mockRedir)
	if err == nil {
		t.Fatal("expected to fail, but did not!")
	}

	return mockRedir
}

func testDoAddRun(t *testing.T, stdinData, nsName string, objects ...runtime.Object) *mockInterceptRuleMgr {
	args := buildCmdArgs(stdinData, testPodName, nsName)