"cannot have associated private key", "",
		},
		{
			"istio_mutual with credential name",
			&networking.ServerTLSSettings{
				Mode:           networking.ServerTLSSettings_ISTIO_MUTUAL,
				CredentialName: "some-cred",
			},
			"cannot have associated credentialName", "",
		},
		{
			"invalid cipher suites",
			&networking.ServerTLSSettings{
				Mode:           networking.ServerTLSSettings_SIMPLE,

		},
	}, {
		testName: "a GMSA cred spec name that is not a valid resource name",
		windowsOptions: &core.WindowsSecurityContextOptions{
			// invalid because of the underscore
			GMSACredentialSpecName: toPtr("not_a-valid-gmsa-crep-spec-name"),
		},
		expectedErrorSubstring: dnsSubdomainLabelErrMsg,
	}, {
		testName: "empty GMSA cred spec contents",

	return allErrs
}

// maxGMSACredentialSpecLength is the max length, in bytes, for the actual contents
// of a GMSA cred spec. In general, those shouldn't be more than a few hundred bytes,
// so we want to give plenty of room here while still providing an upper bound.