// to create or update an EndpointSlice could trigger a retry. With the
	// current rate-limiter in use (1s*2^(numRetries-1)) up to a max of 100s.
	// The following numbers represent the sequence of delays between successive
	// queuings of an Endpoints resource.
	//
	// 1s, 2s, 4s, 8s, 16s, 32s, 64s, 100s (max)
	maxRetries = 15

	// defaultSyncBackOff is the default backoff period for syncEndpoints calls.
	defaultSyncBackOff = 1 * time.Second

		t.Fatalf("error during first connection handshake: %v", err)
	}
}

func TestQUICPostHandshakeClientAuthentication(t *testing.T) {
	// RFC 9001, Section 4.4.
	config := testConfig.Clone()
	config.MinVersion = VersionTLS13
	cli := newTestQUICClient(t, config)
	cli.conn.SetTransportParameters(nil)
	srv := newTestQUICServer(t, config)

        - MUTUAL_TLS
        {{- else }}
        - --controlPlaneAuthPolicy
        - NONE
        {{- end }}
        - --dnsRefreshRate
        - {{ valueOrDefault .Values.global.proxy.dnsRefreshRate "300s" }}
      {{- if (ne (annotation .ObjectMeta "status.sidecar.istio.io/port" .Values.global.proxy.statusPort) "0") }}
        - --statusPort

				WorkloadPort: 8092,
			},
			{
				Name:         tcpMTLS,
				Protocol:     protocol.TCP,
				ServicePort:  8093,
				WorkloadPort: 8093,
			},
			{
				Name:         tcpWL,
				WorkloadPort: 9000,
				Protocol:     protocol.TCP,
			},
		},
	}

	customConfig = append(customConfig, clientConfig, serverNakedFooConfig, serverNakedBarConfig,
		serverNakedFooAltConfig, serverConfig)

        - MUTUAL_TLS
        {{- else }}
        - --controlPlaneAuthPolicy
        - NONE
        {{- end }}
        - --dnsRefreshRate
        - {{ valueOrDefault .Values.global.proxy.dnsRefreshRate "300s" }}
      {{- if (ne (annotation .ObjectMeta "status.sidecar.istio.io/port" .Values.global.proxy.statusPort) "0") }}
        - --statusPort

	return match.Not(excluded)
}

// reachableNakedDestinations filters out naked instances that aren't on the same network.
// While External services are considered "naked", we won't see 500s due to different loadbalancing.
func reachableNakedDestinations(from echo.Instance) match.Matcher {
	srcNw := from.Config().Cluster.NetworkName()
	excluded := match.And(

    public StorageClient storageClient;

    private GenericContainer minioServer;

    @Override
    protected void setUp() throws Exception {
        super.setUp();

        final int port = 9000;
        logger.info("Creating {}", IMAGE_NAME);
        minioServer = new GenericContainer<>(IMAGE_NAME)//
                .withEnv("MINIO_ACCESS_KEY", ACCESS_KEY)//
                .withEnv("MINIO_SECRET_KEY", SECRET_KEY)//

		"allowed service account, matched against the service account in the source principal from the client certificate")
	httpPort = flag.String("http", "8000", "HTTP server port")
	grpcPort = flag.String("grpc", "9000", "gRPC server port")
	denyBody = fmt.Sprintf("denied by ext_authz for not found header `%s: %s` in the request", checkHeader, allowedValue)
)

type (
	extAuthzServerV2 struct{}
	extAuthzServerV3 struct{}
)

						Prefix: extAuthzMatchPrefix,
					},
				},
			},
		},
	}
}

func timeoutOrDefault(t *durationpb.Duration) *durationpb.Duration {
	if t == nil {
		// Default timeout is 600s.
		return &durationpb.Duration{Seconds: 600}
	}
	return t
}

func withBodyRequest(config *meshconfig.MeshConfig_ExtensionProvider_EnvoyExternalAuthorizationRequestBody) *extauthzhttp.BufferSettings {

			// original error code and we cannot check for it here. However, we can at
			// least use its error string to identify the correct localized text for
			// the error to skip.
			var DNS_ERROR_RCODE_SERVER_FAILURE syscall.Errno = 9002
			if strings.HasSuffix(err.Error(), DNS_ERROR_RCODE_SERVER_FAILURE.Error()) {
				testenv.SkipFlaky(t, 38111)
			}
			t.Errorf("failed %s: %s", addr, err)
		}
		if len(names) == 0 {
			t.Errorf("no results")