spec:
  gateways: [missing-gw]
  hosts:
  - reviews
  http:
  - route:
    - destination:
        host: reviews
`).ApplyOrFail(t)
			istioCtl := istioctl.NewOrFail(t, t, istioctl.Config{Cluster: t.Clusters().Default()})
			istioCtl.InvokeOrFail(t, []string{"x", "wait", "-v", "VirtualService", "reviews." + ns.Name()})
		})
}

func TestAnalysisWritesStatus(t *testing.T) {
	// nolint: staticcheck
	framework.NewTest(t).

	}
	diff := difflib.UnifiedDiff{
		FromFile: "Istiod Clusters",
		A:        difflib.SplitLines(istiodBytes.String()),
		ToFile:   "Envoy Clusters",
		B:        difflib.SplitLines(envoyBytes.String()),
		Context:  c.context,
	}
	text, err := difflib.GetUnifiedDiffString(diff)
	if err != nil {
		return err
	}
	if text != "" {
		fmt.Fprintln(c.w, "Clusters Don't Match")
		fmt.Fprintln(c.w, text)
	} else {

kind: feature
area: security
issue:
  - 47489
releaseNotes:
  - |-
    **Added** support for istio CA to handle node authorization for CSRs with impersonate identity from remote clusters.

	"istio.io/istio/pkg/test/scopes"
)

// clusterIndex is the index of a cluster within the KubeConfig or topology file entries
type clusterIndex int

// clusterTopology defines the associations between multiple clusters in a topology.
type clusterTopology = map[clusterIndex]clusterIndex

// ClientFactoryFunc is a transformation function that creates k8s clients
// from the provided k8s config files.

	stdOut, _, err := t.Clusters().Default().
		PodExec(pilot, i.Settings().SystemNamespace, "discovery", cmd)
	if err != nil {
		scopes.Framework.Warnf("failed to force disconnect %s: %v: %v", proxyID, stdOut, err)
	}
}

func scaleDeploymentOrFail(t framework.TestContext, name, namespace string, scale int32) {
	s, err := t.Clusters().Default().Kube().AppsV1().Deployments(namespace).

port: 8080
readOnlyPort: 10255
systemReserved:
  memory: 2Gi
clusterDNS:
  - 192.168.1.1
  - 192.168.1.5
  - 192.168.1.8
`,
			overwrittenConfigFields: map[string]interface{}{
				"Port":         int32(8080),
				"ReadOnlyPort": int32(10255),
				"SystemReserved": map[string]string{
					"memory": "2Gi",
				},
				"ClusterDNS": []string{"192.168.1.1", "192.168.1.5", "192.168.1.8"},
			},

	return c.globalScope.get(ref)
}

func (c *suiteContext) Environment() resource.Environment {
	return c.environment
}

func (c *suiteContext) Clusters() cluster.Clusters {
	return c.Environment().Clusters()
}

func (c *suiteContext) AllClusters() cluster.Clusters {
	return c.Environment().AllClusters()
}

// Settings returns the current runtime.Settings.
func (c *suiteContext) Settings() *resource.Settings {

			templateParams := map[string]string{
				"imagePullSecret": t.Settings().Image.PullSecret,
				"injectLabel":     injectLabel,
				"imagePullPolicy": t.Settings().Image.PullPolicy,
			}

			// we only apply to config clusters
			t.ConfigIstio().Eval(gatewayNs.Name(), templateParams, `apiVersion: v1
kind: Service
metadata:
  name: custom-gateway
  labels:
    istio: ingressgateway
spec:
  ports:
  - port: 80

			clusterCfg: kubeadmapi.ClusterConfiguration{},
			expected: kubeletConfig{
				config: kubeletconfig.KubeletConfiguration{
					FeatureGates:  map[string]bool{},
					StaticPodPath: kubeadmapiv1.DefaultManifestsDir,
					ClusterDNS:    []string{kubeadmapiv1.DefaultClusterDNSIP},
					Authentication: kubeletconfig.KubeletAuthentication{
						X509: kubeletconfig.KubeletX509Authentication{
							ClientCAFile: constants.CACertName,
						},

	filter := newClusterFilter(names)
	clusters := make([]*cluster.Cluster, 0, len(names))
	for defaultClusterName, subsetFilter := range filter {
		builder, err := newClusterBuilder(node, push, defaultClusterName, subsetFilter)
		if err != nil {
			log.Warn(err)
			continue
		}
		clusters = append(clusters, builder.build()...)
	}

	resp := make(model.Resources, 0, len(clusters))
	for _, c := range clusters {