}
	sendAck(ztunClient)

	ztunClient.Close()
	// this will retry for a bit, so shouldn't flake
	mt.Assert(ztunnelConnected.Name(), nil, monitortest.Exactly(0))
}

func podAndNetns() (*v1.Pod, *fakeNs) {
	devNull, err := os.Open(os.DevNull)
	if err != nil {
		panic(err)
	}
	// we can't close this now, because we need to pass it from the ztunnel server to the client

  listeners:
  - attachedRoutes: 1
    conditions:
    - lastTransitionTime: fake
      message: No errors found
      reason: Accepted
      status: "True"
      type: Accepted
    - lastTransitionTime: fake
      message: No errors found
      reason: NoConflicts
      status: "False"
      type: Conflicted
    - lastTransitionTime: fake
      message: No errors found
      reason: Programmed
      status: "True"

  listeners:
  - attachedRoutes: 1
    conditions:
    - lastTransitionTime: fake
      message: No errors found
      reason: Accepted
      status: "True"
      type: Accepted
    - lastTransitionTime: fake
      message: No errors found
      reason: NoConflicts
      status: "False"
      type: Conflicted
    - lastTransitionTime: fake
      message: No errors found
      reason: Programmed
      status: "True"

			return fake.NewNodeClientWithVolumeStats(volumeStatsCapable)
		})
}

func TestClientNodeSupportsVolumeMountGroup(t *testing.T) {
	testClientNodeSupportsCapabilities(t,
		func(client *csiDriverClient) (bool, error) {
			return client.NodeSupportsVolumeMountGroup(context.Background())
		},
		func(volumeMountGroupCapable bool) *fake.NodeClient {

			expectedHint: framework.QueueSkip,
		},
		{
			name: "add pod's label that matches topologySpreadConstraints selector",
			pod: st.MakePod().Name("p").Label("foo", "").
				SpreadConstraint(1, "zone", v1.DoNotSchedule, fooSelector, nil, nil, nil, nil).
				Obj(),
			oldPod:       st.MakePod().Node("fake-node").Obj(),

	server := &fakeServer{}
	server.Start(fakeCtx)

	server.On("DelPodFromMesh",
		fakeCtx,
		pod,
	).Return(errors.New("fake error"))

	fakeClientSet := fake.NewSimpleClientset()
	m := meshDataplane{
		kubeClient: fakeClientSet,
		netServer:  server,
	}

	// pod is not in fake client, so if this will try to remove annotation, it will fail.
	err := m.DelPodFromMesh(fakeCtx, pod)
	assert.Error(t, err)
}

	caerror "istio.io/istio/security/pkg/pki/error"
)

func FuzzCreateCertificate(f *testing.F) {
	fuzz.Fuzz(f, func(fg fuzz.Helper) {
		csr := fuzz.Struct[pb.IstioCertificateRequest](fg)
		ca := fuzz.Struct[mockca.FakeCA](fg)
		ca.SignErr = caerror.NewError(caerror.CSRError, fmt.Errorf("cannot sign"))
		server := &Server{
			ca:             &ca,
			Authenticators: []security.Authenticator{&mockAuthenticator{}},

		ObjectMeta: metav1.ObjectMeta{Name: testHostname},
		Status: v1.NodeStatus{
			VolumesAttached: []v1.AttachedVolume{
				{
					Name:       "fake/fake-device",
					DevicePath: "fake/path",
				},
			}},
	}
	pod := &v1.Pod{
		ObjectMeta: metav1.ObjectMeta{
			Name:      "abc",
			Namespace: "nsA",
			UID:       "1234",
		},
		Spec: v1.PodSpec{
			Containers: []v1.Container{
				{

		if !test.scaleExpected {
			if scaled || len(fake.Actions()) > 0 {
				t.Errorf("unexpected scaling: %v", fake.Actions())
			}
			continue
		}
		if test.scaleExpected && !scaled {
			t.Errorf("expected scaling to occur")
			continue
		}
		if len(fake.Actions()) != 1 {
			t.Errorf("expected 1 action during scale, got: %v", fake.Actions())
			continue
		}

# this test, we instead simulate it by injecting a fake "clang"
# binary that runs the real one as a subprocess.

[!cgo] skip
[short] skip 'builds and links a fake clang binary'
[!cc:clang] skip 'test is specific to clang version parsing'

# Save the location of the real clang command for our fake one to use.
go run ./which clang
cp stdout $WORK/.realclang

# Build a fake clang and ensure that it is the one in $PATH.
mkdir $WORK/bin