}

    fun bootstrapDnsHosts(vararg bootstrapDnsHosts: InetAddress): Builder = bootstrapDnsHosts(bootstrapDnsHosts.toList())

    fun systemDns(systemDns: Dns) =
      apply {
        this.systemDns = systemDns
      }
  }

  companion object {
    val DNS_MESSAGE: MediaType = "application/dns-message".toMediaType()
    const val MAX_RESPONSE_SIZE = 64 * 1024

	public final fun resolvePrivateAddresses (Z)Lokhttp3/dnsoverhttps/DnsOverHttps$Builder;
	public final fun resolvePublicAddresses (Z)Lokhttp3/dnsoverhttps/DnsOverHttps$Builder;
	public final fun systemDns (Lokhttp3/Dns;)Lokhttp3/dnsoverhttps/DnsOverHttps$Builder;
	public final fun url (Lokhttp3/HttpUrl;)Lokhttp3/dnsoverhttps/DnsOverHttps$Builder;
}

public final class okhttp3/dnsoverhttps/DnsOverHttps$Companion {

type FileInfo = fs.FileInfo

// A FileMode represents a file's mode and permission bits.
// The bits have the same definition on all systems, so that
// information about files can be moved from one system
// to another portably. Not all bits apply to all systems.
// The only required bit is [ModeDir] for directories.
type FileMode = fs.FileMode

// The defined file mode bits are the most significant bits of the [FileMode].

	createOrUpdateNamespace(t, s, systemNS, "")

	tracker.WaitOrdered(testNS, systemNS)

	t.Run("change namespace network to nw1", func(t *testing.T) {
		createOrUpdateNamespace(t, s, systemNS, "nw1")
		tracker.WaitOrdered(systemNS)
		expectNetwork(t, s, "nw1")
	})

	t.Run("change namespace network to nw2", func(t *testing.T) {
		createOrUpdateNamespace(t, s, systemNS, "nw2")
		tracker.WaitOrdered(systemNS)

			ObjectMeta: metav1.ObjectMeta{
				Name:      name,
				Namespace: systemNs.Name(),
			},
			Data: map[string][]byte{
				ca.CACertFile:       caCert,
				ca.CAPrivateKeyFile: caKey,
				ca.CertChainFile:    certChain,
				ca.RootCertFile:     rootCert,
			},
		}

		if _, err := cluster.Kube().CoreV1().Secrets(systemNs.Name()).Create(context.TODO(), secret, metav1.CreateOptions{}); err != nil {

	apps      deployment.SingleNamespaceView
	jwtServer jwt.Server
	echoNS    namespace.Instance
	systemNs  namespace.Instance
)

func TestMain(m *testing.M) {
	framework.
		NewSuite(m).
		Label(label.CustomSetup).
		Setup(istio.Setup(&ist, setupConfig)).
		Setup(func(ctx resource.Context) error {
			var err error
			systemNs, err = istio.ClaimSystemNamespace(ctx)
			return err
		}).

func newNodeUntainterTestServer(t *testing.T) *nodeTainterTestServer {
	stop := make(chan struct{})
	t.Cleanup(func() { close(stop) })
	client := kubelib.NewFakeClient()

	nodeUntainter := NewNodeUntainter(stop, client, systemNS, systemNS)
	go nodeUntainter.Run(stop)
	client.RunAndWait(stop)
	kubelib.WaitForCacheSync("test", stop, nodeUntainter.HasSynced)

	pc := clienttest.Wrap(t, nodeUntainter.podsClient)

	echoNS    namespace.Instance
	systemNs  namespace.Instance
)

// remote_jwks is to test fully delegating Envoy to fetch JWKs server (PILOT_JWT_ENABLE_REMOTE_JWKS: envoy).
func TestMain(m *testing.M) {
	framework.
		NewSuite(m).
		Label(label.CustomSetup).
		Setup(istio.Setup(&ist, setupConfig)).
		Setup(func(ctx resource.Context) error {
			var err error
			systemNs, err = istio.ClaimSystemNamespace(ctx)
			return err

func (b *Builder) BuildCompleteSources() *Builder {
	b.t.Helper()
	out := b.Copy()

	systemNS := istio.ClaimSystemNamespaceOrFail(out.t, out.t)

	// Build all the complete config that doesn't require well-known parameters.
	for _, s := range out.complete {
		out.addYAML(withParams(s, param.Params{
			param.SystemNamespace.String(): systemNS,
		}))
	}

	return out
}

	cMinIstioVersion         = "1.15.0"
	// cMinIstioVersionDS       = "1.16.0"
)

func TestReachability(t *testing.T) {
	framework.NewTest(t).
		Run(func(t framework.TestContext) {
			systemNS := istio.ClaimSystemNamespaceOrFail(t, t)

			integIstioVersion := cMinIstioVersion
			var migrationApp echo.Instances
			// if dual stack is enabled, a dual stack echo config should be added