func TestUnsupportedFilters(t *testing.T) {
	testCases := []struct {
		inputXML    string
		expectedErr error
	}{
		{ // Filter with And tags
			inputXML: ` <Filter>
						<And>
							<Prefix>key-prefix</Prefix>
						</And>
						</Filter>`,
			expectedErr: errXMLNotWellFormed,
		},
		{ // Filter with Tag tags
			inputXML: ` <Filter>
						<Tag>
							<Key>key1</Key>

			}
			opts, err := NewPolicyOptions(tcase.policyOptions)
			if tcase.expectedErr != nil {
				if !strings.Contains(err.Error(), tcase.expectedErr.Error()) {
					t.Errorf("Unexpected error message. Have: %s wants %s", err.Error(), tcase.expectedErr.Error())
				}
			}

			if opts != tcase.expectedOptions {

		switch {
		case testCase.expectedErr == nil:
			if err != nil {
				t.Fatalf("error: expected: %v, got: %v", testCase.expectedErr, err)
			}
		case err == nil:
			t.Fatalf("error: expected: %v, got: %v", testCase.expectedErr, err)
		case testCase.expectedErr.Error() != err.Error():
			t.Fatalf("error: expected: %v, got: %v", testCase.expectedErr, err)
		}

		if testCase.expectedResult != result {

	}

	tcs := map[string]struct {
		discoveryError    error
		expectedErr       bool
		possibleResources []*metav1.APIResourceList
	}{
		"No Discovery Error": {
			discoveryError:    nil,
			possibleResources: possibleDiscoveryResource(),
			expectedErr:       false,
		},
		"Discovery Calls Partially Failed": {
			discoveryError:    new(discovery.ErrGroupDiscoveryFailed),

		Namespace   string
		Name        string
		ExpectedErr bool
	}{
		"valid": {
			Namespace:   "foo",
			Name:        "bar",
			ExpectedErr: false,
		},
		"empty": {
			ExpectedErr: true,
		},
		"empty namespace": {
			Namespace:   "",
			Name:        "foo",
			ExpectedErr: true,
		},
		"empty name": {
			Namespace:   "foo",
			Name:        "",
			ExpectedErr: true,
		},
		"extra segments": {

	testCases := map[string]struct {
		hosts       string
		expectedExt *pkix.Extension
	}{
		"URI host": {
			hosts:       "spiffe://test.domain.com/ns/default/sa/default",
			expectedExt: getSANExtension([]Identity{uriIdentity}, t),
		},
		"IP host": {
			hosts:       "10.0.0.1",
			expectedExt: getSANExtension([]Identity{ipIdentity}, t),
		},
		"DNS host": {
			hosts:       "test.domain.com",

	for name, tt := range map[string]struct {
		in          string
		data        map[string]string
		files       map[string]string
		expected    string
		expectedErr string
	}{
		"missing-file": {
			in:          `{{include "no-such-file.txt"}}`,
			expectedErr: noFileErr.Error(),
		},
		"data": {
			in:       `{{.Hello}} {{.World}}`,
			data:     map[string]string{"Hello": "world", "World": "hello"},

				err = endpoint.UpdateIsLocal()
			}

			switch {
			case test.expectedErr == nil:
				if err != nil {
					t.Errorf("error: expected = <nil>, got = %v", err)
				}
			case err == nil:
				t.Errorf("error: expected = %v, got = <nil>", test.expectedErr)
			case test.expectedErr.Error() != err.Error():
				t.Errorf("error: expected = %v, got = %v", test.expectedErr, err)
			}

			if err == nil {

			expectedErr:  true,
		},
		{
			name:         "InvalidBaz",
			fileContents: bytes.Join([][]byte{files["foo"], files["baz"]}, []byte(constants.YAMLDocumentSeparator)),
			expectedErr:  true,
		},
		{
			name:         "InvalidNoKind",
			fileContents: files["nokind"],
			expectedErr:  true,
		},
		{
			name:         "InvalidNoAPIVersion",

		// regular errors return errors but do not retry
		{name: "404 doesnt retry", attr: aliceAttr, allow: false, statusCode: 404, expectedErr: true, expectedAuthorized: false, expectedCalls: 1},
		{name: "403 doesnt retry", attr: aliceAttr, allow: false, statusCode: 403, expectedErr: true, expectedAuthorized: false, expectedCalls: 1},