}
}

func iamLogEvent(ctx context.Context, msg string, args ...interface{}) {
	logger.Event(ctx, "iam", msg, args...)
}

func rebalanceLogIf(ctx context.Context, err error, errKind ...interface{}) {
	logger.LogIf(ctx, "rebalance", err, errKind...)
}

func rebalanceLogEvent(ctx context.Context, msg string, args ...interface{}) {
	logger.Event(ctx, "rebalance", msg, args...)
}

			},
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			features.IstiodServiceCustomHost = tc.customHost
			var args PilotArgs
			args.Revision = tc.revision
			args.Namespace = "istio-system"
			sans := getDNSNames(&args, tc.discoveryAddress)
			assert.Equal(t, sans, tc.sans)
		})
	}

	if hasSessionPolicy {
		return isAllowedSP && (isOwnerDerived || combinedPolicy.IsAllowed(args))
	}

	// Sub policy not set, this is most common since subPolicy
	// is optional, use the inherited policies.
	return isOwnerDerived || combinedPolicy.IsAllowed(args)
}

func isAllowedBySessionPolicyForServiceAccount(args policy.Args) (hasSessionPolicy bool, isAllowed bool) {

	Time      string
}

func (args vsArgs) Config(t *testing.T, variant string) string {
	if args.Time == "" {
		args.Time = TimeBase
	}

	if args.Matches == nil {
		args.Matches = []string{args.Match}
	}
	if variant == "httproute" {
		if args.GwMatches == nil {
			args.GwMatches = make([]types.NamespacedName, 0, len(args.Matches))
			for _, m := range args.Matches {
				spl := strings.Split(m, ".")

		n := 0
		// Use the following trick to filter in place
		// https://github.com/golang/go/wiki/SliceTricks#filter-in-place
		for _, bucketInfo := range bucketsInfo {
			if globalIAMSys.IsAllowed(policy.Args{
				AccountName:     cred.AccessKey,
				Groups:          cred.Groups,
				Action:          policy.ListBucketAction,
				BucketName:      bucketInfo.Name,
				ConditionValues: getConditionValues(r, "", cred),