return nil, err
			}
			certificate.Watch(ctx, 15*time.Minute, syscall.SIGHUP)

			conf.GetClientCertificate = func(*tls.CertificateRequestInfo) (*tls.Certificate, error) {
				cert := certificate.Get()
				return &cert, nil
			}
		}

		var caDir string
		if opts != nil {
			caDir = opts.CADir
		}
		conf.RootCAs, err = certs.GetRootCAs(env.Get(EnvKESServerCA, caDir))
		if err != nil {
			return nil, err

# fluentd-gcp-configmap-old.yaml will be used for ingesting logs against old
# resources like "gke_container" and "gce_instance".
kind: ConfigMap
apiVersion: v1
data:
  containers.input.conf: |-
    # This configuration file for Fluentd is used
    # to watch changes to Docker log files that live in the
    # directory /var/lib/docker/containers/ and are symbolically

plugins {
    id 'distribution'
}
${mavenCentralRepository()}

configurations {
    conf.incoming.afterResolve {
        distributions {
            myDist {
                contents {}
            }
        }
    }
}

task resolve {
    dependsOn configurations.conf
    doFirst {
        configurations.conf.files // Trigger `afterResolve`
        assert distributions*.name.contains('myDist')
    }

        when:
        buildFile << """
configurations {
    conf
}

task assertUnresolved {
    doLast {
        assert configurations.conf.state == Configuration.State.UNRESOLVED
    }
}

task war(type: War) {
    dependsOn assertUnresolved
    classpath = configurations.conf
    destinationDirectory = buildDir
}
"""

        then:
        succeeds "war"

			},
			expectedOrganization: testCertOrganization,
		},
		{
			name:     "Certificate renewal for a certificate embedded in a kubeconfig file",
			certName: "admin.conf",
			createCertFunc: func() *x509.Certificate {
				return writeTestKubeconfig(t, dir, "admin.conf", testCACert, testCAKey, notBefore, notAfter)
			},
			expectedOrganization: testCertOrganization,
		},
	}

	for _, test := range tests {

        file('a/build.gradle') << """
            configurations { conf }
            dependencies { conf project(path: ":b", configuration: "conf") }
            task resolveConf {
                doLast {
                    //resolves at execution time, forcing 'b' to get configured
                    configurations.conf.files
                }
            }
        """

	}

	resolvConf := "/etc/resolv.conf"
	// If running as root and the alternate resolv.conf file exists, use it instead.
	// This is used when running in Docker or VMs, without iptables DNS interception.
	if strings.HasSuffix(addr, ":53") {
		if os.Getuid() == 0 {
			h.respondBeforeSync = true
			// TODO: we can also copy /etc/resolv.conf to /var/lib/istio/resolv.conf and
			// replace it with 'nameserver 127.0.0.1'

        when:
        thing1.onMethodMissing = { name, args -> [].foo() }
        conf(thing1) { m1() }

        then:
        def e = thrown(MissingMethodException)
        e.method == "foo"

        when:
        thing1.onPropertyMissingGet = { new Object().bar }
        conf(thing1) { abc }

        then:
        e = thrown(MissingPropertyException)
        e.property == "bar"

	expectedPostCleanFile, tempCNIConfDir, tempCNIBinDir, tempK8sSvcAcctDir string,
) {
	t.Logf("prior cni-conf='%v', expected result='%v'", preConfFile, resultFileName)

	// disable monitoring & repair
	viper.Set(constants.MonitoringPort, 0)
	viper.Set(constants.RepairEnabled, false)

	// Don't set the CNI conf file env var if preConfFile is not set
	var envPreconf string
	if preConfFile != "" {
		envPreconf = preConfFile

            configurations {
                conf
            }

            def dep = dependencies.create("org:dep:1.0")

            task resolve {
                Closure depClosure = { d -> true }
                Spec<Dependency> depSpec = (d) -> true

                configurations.conf.files(dep)
                configurations.conf.files(depSpec)
                configurations.conf.files(depClosure)