svcSubnet:   "fd03::/112,",
			expectedErr: true,
		},
	}
	for _, rt := range tests {
		t.Run(rt.name, func(t *testing.T) {
			virtualIP, err := GetAPIServerVirtualIP(rt.svcSubnet)
			if (err != nil) != rt.expectedErr {
				t.Errorf("failed APIServerVirtualIP:\n\texpectedErr: %v, got: %v", rt.expectedErr, err)
			} else if !rt.expectedErr {
				if virtualIP.String() != rt.expectedIP {
					t.Errorf(

				t.Error(dump.Pretty(actual))
			}
			switch {
			case err == nil && len(test.expectedErr) == 0:
			case err == nil && len(test.expectedErr) != 0:
				t.Errorf("missing %q", test.expectedErr)
			case err != nil && len(test.expectedErr) == 0:
				t.Error(err)
			case err != nil && err.Error() != test.expectedErr:
				t.Error(err)
			}
		})
	}

}

func compareResults(t *testing.T, expected, actual []types.UID) {
	expectedSet := sets.New[string]()
	for _, u := range expected {
		expectedSet.Insert(string(u))
	}
	actualSet := sets.New[string]()
	for _, u := range actual {
		actualSet.Insert(string(u))
	}
	if !expectedSet.Equal(actualSet) {
		t.Errorf("Expected %#v, got %#v", sets.List(expectedSet), sets.List(actualSet))
	}
}

func TestGetWork(t *testing.T) {

func TestUnsupportedFilters(t *testing.T) {
	testCases := []struct {
		inputXML    string
		expectedErr error
	}{
		{ // Filter with And tags
			inputXML: ` <Filter>
						<And>
							<Prefix>key-prefix</Prefix>
						</And>
						</Filter>`,
			expectedErr: errXMLNotWellFormed,
		},
		{ // Filter with Tag tags
			inputXML: ` <Filter>
						<Tag>
							<Key>key1</Key>

			}
			opts, err := NewPolicyOptions(tcase.policyOptions)
			if tcase.expectedErr != nil {
				if !strings.Contains(err.Error(), tcase.expectedErr.Error()) {
					t.Errorf("Unexpected error message. Have: %s wants %s", err.Error(), tcase.expectedErr.Error())
				}
			}

			if opts != tcase.expectedOptions {

		switch {
		case testCase.expectedErr == nil:
			if err != nil {
				t.Fatalf("error: expected: %v, got: %v", testCase.expectedErr, err)
			}
		case err == nil:
			t.Fatalf("error: expected: %v, got: %v", testCase.expectedErr, err)
		case testCase.expectedErr.Error() != err.Error():
			t.Fatalf("error: expected: %v, got: %v", testCase.expectedErr, err)
		}

		if testCase.expectedResult != result {

	}

	tcs := map[string]struct {
		discoveryError    error
		expectedErr       bool
		possibleResources []*metav1.APIResourceList
	}{
		"No Discovery Error": {
			discoveryError:    nil,
			possibleResources: possibleDiscoveryResource(),
			expectedErr:       false,
		},
		"Discovery Calls Partially Failed": {
			discoveryError:    new(discovery.ErrGroupDiscoveryFailed),

		Namespace   string
		Name        string
		ExpectedErr bool
	}{
		"valid": {
			Namespace:   "foo",
			Name:        "bar",
			ExpectedErr: false,
		},
		"empty": {
			ExpectedErr: true,
		},
		"empty namespace": {
			Namespace:   "",
			Name:        "foo",
			ExpectedErr: true,
		},
		"empty name": {
			Namespace:   "foo",
			Name:        "",
			ExpectedErr: true,
		},
		"extra segments": {

	testCases := map[string]struct {
		hosts       string
		expectedExt *pkix.Extension
	}{
		"URI host": {
			hosts:       "spiffe://test.domain.com/ns/default/sa/default",
			expectedExt: getSANExtension([]Identity{uriIdentity}, t),
		},
		"IP host": {
			hosts:       "10.0.0.1",
			expectedExt: getSANExtension([]Identity{ipIdentity}, t),
		},
		"DNS host": {
			hosts:       "test.domain.com",

	for name, tt := range map[string]struct {
		in          string
		data        map[string]string
		files       map[string]string
		expected    string
		expectedErr string
	}{
		"missing-file": {
			in:          `{{include "no-such-file.txt"}}`,
			expectedErr: noFileErr.Error(),
		},
		"data": {
			in:       `{{.Hello}} {{.World}}`,
			data:     map[string]string{"Hello": "world", "World": "hello"},