add(t, dc.pdbStore, pdb)
	dc.sync(ctx, pdbName)
	// This verifies that when a PDB has 0 pods, disruptions are not allowed.
	ps.VerifyDisruptionAllowed(t, pdbName, 0)

	pod, _ := newPod(t, "naked")
	add(t, dc.podStore, pod)
	dc.sync(ctx, pdbName)

	ps.VerifyDisruptionAllowed(t, pdbName, 0)
	verifyEventEmitted(t, dc, "UnmanagedPods")

}

			mtlsOnExpect := func(from echo.Instance, opts echo.CallOptions) bool {
				if from.Config().IsNaked() || opts.To.Config().IsNaked() {
					// If one of the two endpoints is naked, we don't send mTLS
					return false
				}
				if opts.To.Config().IsHeadless() && opts.To.Instances().Contains(from) {
					// pod calling its own pod IP will not be intercepted
					return false
				}

	if noparen != original {
		t.Errorf("got %q, want %q", noparen, original)
	}
}

// Verify that we don't print a newline between "return" and its results, as
// that would incorrectly cause a naked return.
func TestIssue32854(t *testing.T) {
	src := `package foo

func f() {
        return Composite{
                call(),
        }
}`
	fset := token.NewFileSet()

	modes := []string{"STRICT", "PERMISSIVE", "DISABLE"}

	mtlsHost := host.Name(t.Apps.A.Config().ClusterLocalFQDN())
	nakedHost := host.Name(t.Apps.Naked.Config().ClusterLocalFQDN())
	httpsPort := ports.HTTP.ServicePort
	httpsAutoPort := ports.AutoHTTPS.ServicePort
	snis := []string{
		model.BuildSubsetKey(model.TrafficDirectionOutbound, "", mtlsHost, httpsPort),

import org.gradle.internal.service.scopes.ServiceScope;

import java.util.Set;

/**
 * Enriches class loading with empty interfaces for certain types that have been removed,
 * but which are baked into the bytecode generated by the Groovy compiler.
 */
@ServiceScope(Scope.Global.class)
public interface LegacyTypesSupport {

    /**

	// (for whatever value of GOROOT is baked into the binary, not the one
	// that may be set in the environment).
	fileGoroot := ""
	if envGoroot := os.Getenv("GOROOT"); envGoroot != "" {
		// Since GOROOT is set explicitly in the environment, we can't be certain
		// that it is the same GOROOT value baked into the binary, and we can't

		Ports:             ports.All(),
		// Set up TLS certs on the server. This will make the server listen with these credentials.
		TLSSettings: &common.TLSSettings{
			// Echo has these test certs baked into the docker image
			RootCert:   file.MustAsString(path.Join(env.IstioSrc, "tests/testdata/certs/dns/root-cert.pem")),
			ClientCert: file.MustAsString(path.Join(env.IstioSrc, "tests/testdata/certs/dns/cert-chain.pem")),

! exec ./example.test-trimpath.exe -test.v
stdout '^GOROOT $'
stderr 'cannot find package "runtime" in any of:\n\t\(\$GOROOT not set\)\n\t'$WORK${/}gopath${/}src${/}runtime' \(from \$GOPATH\)$'

# If a correct GOROOT is baked in to the 'go' command itself, 'go run' and
# 'go test' should not implicitly set GOROOT in the process environment
# (because that could mask an unexpected production dependency on the GOROOT

So basically selecting the right binary for one of the above cases is a heuristic with 2 inputs:

				TLS:          true,
			},
		},
		// Set up TLS certs on the server. This will make the server listen with these credentials.
		TLSSettings: &common.TLSSettings{
			// Echo has these test certs baked into the docker image
			RootCert:   mustReadCert("root-cert.pem"),
			ClientCert: mustReadCert("cert-chain.pem"),
			Key:        mustReadCert("key.pem"),
			// Override hostname to match the SAN in the cert we are using