)

var _ resource.Environment = FakeEnvironment{}

// FakeEnvironment for testing.
type FakeEnvironment struct {
	Name        string
	NumClusters int
	IDValue     string
}

func (f FakeEnvironment) ID() resource.ID {
	return resource.FakeID(f.IDValue)
}

func (f FakeEnvironment) IsMultiCluster() bool {
	return false
}

func (f FakeEnvironment) IsMultiNetwork() bool {
	return false
}

		// KMS Key APIs
		kmsRouter.Methods(http.MethodPost).Path(version+"/key/create").HandlerFunc(gz(httpTraceAll(kmsAPI.KMSCreateKeyHandler))).Queries("key-id", "{key-id:.*}")
		kmsRouter.Methods(http.MethodGet).Path(version+"/key/list").HandlerFunc(gz(httpTraceAll(kmsAPI.KMSListKeysHandler))).Queries("pattern", "{pattern:.*}")

				"server",
				"x-forwarded-client-cert",
				"x-request-id",
			)

			allowedClientHeaders := sets.New(
				// Envoy has no way to turn this off
				"x-forwarded-proto",
				// Metadata exchange: under discussion of how we can strip this, but for now there is no way
				"x-envoy-peer-metadata",
				"x-envoy-peer-metadata-id",
				// Tracing decorator. We may consider disabling this if tracing is off?

	if err != nil {
		return nil, nil, err
	}

	kdfInit, ok := SupportedKDFs[kdfID]
	if !ok {
		return nil, nil, errors.New("unsupported KDF id")
	}
	kdf := kdfInit()

	aeadInfo, ok := SupportedAEADs[aeadID]
	if !ok {
		return nil, nil, errors.New("unsupported AEAD id")
	}

	pskIDHash := kdf.LabeledExtract(suiteID, nil, "psk_id_hash", nil)
	infoHash := kdf.LabeledExtract(suiteID, nil, "info_hash", info)

	args, err := r.readArgs(len(spec.Args))
	if err != nil {
		return Event{}, err
	}
	if spec.IsStack {
		len := int(args[1])
		for i := 0; i < len; i++ {
			// Each stack frame has four args: pc, func ID, file ID, line number.
			frame, err := r.readArgs(4)
			if err != nil {
				return Event{}, err
			}
			args = append(args, frame...)
		}
	}
	var data []byte
	if spec.HasData {
		data, err = r.readData()

		// TODO: allow locking down, rejecting unauthenticated requests.
		id, err := checkConnectionIdentity(con.proxy, identities)
		if err != nil {
			log.Warnf("Unauthorized XDS: %v with identity %v: %v", con.Peer(), identities, err)
			return status.Newf(codes.PermissionDenied, "authorization failed: %v", err).Err()
		}
		con.proxy.VerifiedIdentity = id
	}
	return nil
}

	val.Store(initial)
	x := &static[T]{
		val:           val,
		id:            nextUID(),
		eventHandlers: &handlers[T]{},
	}
	return collectionAdapter[T]{x}
}

// static represents a Collection of a single static value. This can be explicitly Set() to override it
type static[T any] struct {
	val           *atomic.Pointer[T]
	id            collectionUID
	eventHandlers *handlers[T]
}

		s.environment.Watcher,
		serviceentry.WithClusterID(s.clusterID),
	)
	serviceControllers.AddRegistry(s.serviceEntryController)

	registered := sets.New[provider.ID]()
	for _, r := range args.RegistryOptions.Registries {
		serviceRegistry := provider.ID(r)
		if registered.Contains(serviceRegistry) {
			log.Warnf("%s registry specified multiple times.", r)
			continue
		}
		registered.Insert(serviceRegistry)

of a single argument 'data' and a Go-quoted string representing the byte data
within. Note: an explicit argument for the length is elided, because it's
just the length of the unquoted string.

For example:

	String id=5
		data="hello world\x00"

These events are identified in their spec by the HasData flag.

The second special case consists of stack events. These events are identified

	}

	auditContext := audit.AuditContextFrom(ctx)
	issuedCredentialID, ok := auditContext.Event.Annotations["authentication.kubernetes.io/issued-credential-id"]
	if !ok || len(issuedCredentialID) == 0 {
		t.Errorf("did not find issued-credential-id in audit event annotations")
	}
}

func TestUpdate(t *testing.T) {
	storage, server := newStorage(t)
	defer server.Terminate(t)
	defer storage.Store.DestroyFunc()