Source(config.File("testdata/authz/allow-principal.yaml.tmpl").WithParams(
					param.Params{
						"Allowed": allowed,
					})).
				BuildAll(nil, to).
				Apply()

			newTrafficTest(t, fromAndTo).
				FromMatch(fromMatch).
				ToMatch(toMatch).
				Run(func(t framework.TestContext, from echo.Instance, to echo.Target) {
					allow := allowValue(from.NamespacedName() == allowed.NamespacedName())

							opts.HTTP.Headers = headers.New().
								WithHost(fmt.Sprintf("example.%s.com", to.ServiceName())).
								Build()
							opts.Check = check.OK()
						},
					},
				}

				newTrafficTest(t, apps.A.Append(apps.B)).
					RunViaGatewayIngress("istio", func(t framework.TestContext, from ingress.Instance, to echo.Target) {
						for _, c := range cases {

						config.New(t).
							Source(config.File(policy).WithParams(param.Params{
								"JWTServer": jwtServer,
							})).
							BuildAll(nil, apps.Ns1.All).
							Apply()
					}

					newTrafficTest(t, apps.Ns1.All.Instances()).Run(func(t framework.TestContext, from echo.Instance, to echo.Target) {
						for _, c := range cases {
							t.NewSubTest(c.name).Run(func(t framework.TestContext) {

				t.NewSubTest(tt.name).Run(func(t framework.TestContext) {
					istio.GetOrFail(t, t).PatchMeshConfigOrFail(t, t, fmt.Sprintf(`
pathNormalization:
  normalization: %v`, tt.ntype.String()))

					newTrafficTest(t, apps.Ns1.All.Instances()).
						FromMatch(match.ServiceName(apps.Ns1.A.NamespacedName())).
						Run(func(t framework.TestContext, from echo.Instance, to echo.Target) {
							for _, expected := range tt.expectations {