"istio.io/istio/pkg/test/framework/components/istio/ingress"
	"istio.io/istio/pkg/test/framework/label"
	"istio.io/istio/tests/common/jwt"
)

func TestGatewayAPIRequestAuthentication(t *testing.T) {
	framework.NewTest(t).
		Label(label.IPv4). // https://github.com/istio/istio/issues/35835
		Run(func(t framework.TestContext) {
			crd.DeployGatewayAPIOrSkip(t)
			config.New(t).

```go
  func TestExample(t *testing.T) {
    framework.NewTest(t).NotImplementedYet("my.feature.string")
  }

	"istio.io/istio/pkg/test/util/assert"
	"istio.io/istio/pkg/test/util/retry"
	ingressutil "istio.io/istio/tests/integration/security/sds_ingress/util"
)

func TestGateway(t *testing.T) {
	framework.
		NewTest(t).
		Run(func(t framework.TestContext) {
			crd.DeployGatewayAPIOrSkip(t)

			t.NewSubTest("unmanaged").Run(UnmanagedGatewayTest)
			t.NewSubTest("managed").Run(ManagedGatewayTest)

// This is to simulate the case where CNI and Istio control plane versions are out of sync during upgrade.
func TestCNIVersionSkew(t *testing.T) {
	framework.
		NewTest(t).
		Run(func(t framework.TestContext) {
			if !i.Settings().EnableCNI {
				t.Skip("CNI version skew test is only tested when CNI is enabled.")
			}
			for _, v := range versions {
				installCNIOrFail(t, v)

)

// TestRemoteJwks tests always delegate Envoy to fetch http jwks server.
func TestRemoteJwks(t *testing.T) {
	payload1 := strings.Split(jwt.TokenIssuer1, ".")[1]
	framework.NewTest(t).
		Run(func(t framework.TestContext) {
			ns := apps.EchoNamespace.Namespace

			cases := []struct {
				name          string
				policyFile    string
				delay         string
				timeout       string

// "server-naked-foo" succeeds, and requests to "server-naked-bar" fails.
func TestTrustDomainAliasSecureNaming(t *testing.T) {
	framework.NewTest(t).
		Run(func(t framework.TestContext) {
			testNS := apps.EchoNamespace.Namespace

			t.ConfigIstio().YAML(testNS.Name(), POLICY).ApplyOrFail(t)

			for _, cluster := range t.Clusters() {

		RequireMinVersion(17).
		Setup(common.InstallMCSCRDs).
		Setup(istio.Setup(&i, enableMCSAutoExport)).
		Setup(common.DeployEchosFunc("se", &echos)).
		Run()
}

func TestAutoExport(t *testing.T) {
	framework.NewTest(t).
		Run(func(ctx framework.TestContext) {
			serviceExportGVR := common.KubeSettings(ctx).ServiceExportGVR()
			// Verify that ServiceExport is created automatically for services.
			ctx.NewSubTest("exported").RunParallel(

	"istio.io/client-go/pkg/apis/networking/v1alpha3"
	"istio.io/istio/pkg/test/framework"
	"istio.io/istio/pkg/test/util/retry"
)

func TestWebhook(t *testing.T) {
	// nolint: staticcheck
	framework.NewTest(t).
		RequiresSingleCluster().
		Run(func(t framework.TestContext) {
			vwcName := "istio-validator"
			if t.Settings().Revisions.Default() != "" {
				vwcName = fmt.Sprintf("%s-%s", vwcName, t.Settings().Revisions.Default())

	"istio.io/istio/pkg/test/framework/components/namespace"
	"istio.io/istio/pkg/test/framework/resource/config/apply"
	"istio.io/istio/pkg/util/sets"
)

func TestProxyHeaders(t *testing.T) {
	framework.NewTest(t).
		RequireIstioVersion("1.19").
		Run(func(t framework.TestContext) {
			ns := namespace.NewOrFail(t, t, namespace.Config{Prefix: "proxy-headers", Inject: true})
			cfg := echo.Config{
				Namespace: ns,

	"istio.io/istio/pkg/test/framework/components/namespace"
	kubetest "istio.io/istio/pkg/test/kube"
)

func TestRevisionTags(t *testing.T) {
	// nolint: staticcheck
	framework.NewTest(t).
		RequiresSingleCluster().
		RequiresLocalControlPlane().
		Run(func(t framework.TestContext) {
			tcs := []struct {
				name     string
				tag      string
				revision string
				nsLabel  string