if expectMTLS {
										opts.Check = check.And(opts.Check,
											check.MTLSForHTTP())
									}
								} else {
									tpe = "negative"
									opts.Check = check.NotOK()
								}
								include := c.Include
								if include == nil {
									include = func(_ echo.Instance, _ echo.CallOptions) bool { return true }
								}
								if include(from, opts) {

											} else {
												opts.Check = check.And(opts.Check, check.ReachedClusters(t.Clusters(), expectedClusters))
											}
										}
									} else {
										opts.Check = check.NotOK()
									}
									from.CallOrFail(t, opts)
								})
						})
					}
				})
			}
		})
}

type condition func(from echo.Instance, opts echo.CallOptions) bool

									if !src.Config().WaypointClient() && dst.Config().HasAnyWaypointProxy() {
										// TODO currently leads to no L7 processing, in the future it might be denied
										// opt.Check = check.NotOK()
										opt.Check = tcpValidator
									}

									// Only marked to use service waypoint. We'll deny since it's not traversed.
									// Not traversed, since traffic is to-workload IP.

						opts.HTTP.Path = "/valid-token-forward-remote-jwks"
						opts.HTTP.Headers = headers.New().WithAuthz(jwt.TokenIssuer1).Build()
						opts.Check = check.And(
							check.NotOK(),
							check.Status(http.StatusUnauthorized))
					},
				},
			}))

			t.NewSubTest("aud").Run(newTest("testdata/requestauthn/aud.yaml.tmpl", []testCase{
				{
					name: "invalid-aud",

// NOTOC -> dynamic [P8/default]: A P8 compatible, non-PIC stub is generated
// NOTOC -> dynamic [P8/pie]:     A P8 compatible, PIC stub is generated
//
//
// Some notes about other cases:
//   TOC -> TOC, NOTOC -> NOTOC, NOTOC -> TOC  local calls do not require require call stubs.
//   TOC -> NOTOC (R2 is preserved, st_other==0): A special case where a call stub is not needed.

		t.Run(tt.name, func(t *testing.T) {
			v := Value{
				value: tt.fields.value,
			}
			gotVal, gotOk := v.bytesToBool()
			if gotVal != tt.wantVal {
				t.Errorf("bytesToBool() gotVal = %v, want %v", gotVal, tt.wantVal)
			}
			if gotOk != tt.wantOk {
				t.Errorf("bytesToBool() gotOk = %v, want %v", gotOk, tt.wantOk)
			}
		})
	}

			}
			if gotMinorVersion != tt.wantMinorVersion {
				t.Errorf("parseKubeVersion() gotMinorVersion = %v, want %v", gotMinorVersion, tt.wantMinorVersion)
			}
			if gotOk != tt.wantOk {
				t.Errorf("parseKubeVersion() gotOk = %v, want %v", gotOk, tt.wantOk)
			}
		})
	}

				if i > 0 {
					rng.Shuffle(len(tt.m), func(i, j int) {
						tt.m[i], tt.m[j] = tt.m[j], tt.m[i]
					})
				}
				gotSelected, gotOk := tt.m.resolve(&tt.r)
				if gotOk != tt.wantOk {
					t.Errorf("resolve() gotOk = %v, want %v", gotOk, tt.wantOk)
				}
				if gotSelected != nil {
					gotSelected.cached = nil
					gotSelected.reusable = false
				}

  border: 1px solid #d1d2d3;
  border-radius: 2px 0 0 2px;
  padding: 0.25em;
  padding-left: 28px;
  margin-left: 1em;
  font-family: 'Roboto', 'Noto', sans-serif;
  font-size: 1em;
  line-height: 24px;
  color: #212121;
}
.downArrow {
  border-top: .36em solid #ccc;
  border-left: .36em solid transparent;
  border-right: .36em solid transparent;

					ldr.Errorf(s, "Unsupported NOTOC external reference call into %s", ldr.SymName(r.Sym()))

				case sym.STEXT:
					targ := r.Sym()
					if (ldr.AttrExternal(targ) && ldr.SymLocalentry(targ) <= 1) || (!ldr.AttrExternal(targ) && (!ldr.AttrShared(targ) || hasPCrel)) {
						// This is NOTOC to NOTOC call (st_other is 0 or 1). No call stub is needed.
					} else {
						// This is a NOTOC to TOC function. Generate a calling stub.