t.Run(fmt.Sprintf("case %d %s", i, strings.Join(c.args, " ")), func(t *testing.T) {
			verifyExecTestOutput(t, ZtunnelConfig(cli.NewFakeContext(&cli.NewFakeContextOption{
				Results:   c.execClientConfig,
				Namespace: "default",
			})), c)
		})
	}
}

func verifyExecTestOutput(t *testing.T, cmd *cobra.Command, c execTestCase) {
	t.Helper()

	var out bytes.Buffer
	cmd.SetArgs(c.args)
	cmd.SilenceUsage = true

	GlobalKMS = nil
}

func execExtended(t *testing.T, fn func(t *testing.T, init func(), bucketOptions MakeBucketOptions)) {
	// Exec with default settings...
	resetCompressEncryption()
	t.Run("default", func(t *testing.T) {
		fn(t, nil, MakeBucketOptions{})
	})
	t.Run("default+versioned", func(t *testing.T) {
		fn(t, nil, MakeBucketOptions{VersioningEnabled: true})
	})

	t.Run("compressed", func(t *testing.T) {

* The **HTTPS certificates** "certify" a **certain domain**, but the protocol and encryption happen at the TCP level, **before knowing** which domain is being dealt with.
* **By default**, that would mean that you can only have **one HTTPS certificate per IP address**.
    * No matter how big your server is or how small each application you have on it might be.
    * There is a **solution** to this, however.

	case isOwnerDerived:
		// All actions are allowed by default and no policy evaluation is
		// required.

	case roleArn != "":
		arn, err := arn.Parse(roleArn)
		if err != nil {
			iamLogIf(GlobalContext, fmt.Errorf("error parsing role ARN %s: %v", roleArn, err))
			return false
		}
		svcPolicies = newMappedPolicy(sys.rolesMap[arn]).toSlice()
	default:
		// Check policy for parent user of service account.

 *   <li>{@link UnmodifiableListIterator}
 * </ul>
 *
 * <h2>Forwarding collections</h2>
 *
 * We provide implementations of collections that forward all method calls to a delegate collection
 * by default. Subclasses can override one or more methods to implement the decorator pattern. For
 * an example, see {@link ForwardingCollection}.
 *
 * <h2>Other</h2>
 *
 * <ul>
 *   <li>{@link EvictingQueue}

                        ASN1OctetString mechanismListMIC = ASN1OctetString.getInstance(tagged, true);
                        setMechanismListMIC(mechanismListMIC.getOctets());
                        break;
                    default:
                        throw new IOException("Malformed token field.");
                    }
                }
        }
    }

 *   <li>{@link UnmodifiableListIterator}
 * </ul>
 *
 * <h2>Forwarding collections</h2>
 *
 * We provide implementations of collections that forward all method calls to a delegate collection
 * by default. Subclasses can override one or more methods to implement the decorator pattern. For
 * an example, see {@link ForwardingCollection}.
 *
 * <h2>Other</h2>
 *
 * <ul>
 *   <li>{@link EvictingQueue}

			// Reset the timer for next cycle.
			callhomeTimer.Reset(globalCallhomeConfig.FrequencyDur())
		}
	}
}

func performCallhome(ctx context.Context) {
	deadline := 10 * time.Second // Default deadline is 10secs for callhome
	objectAPI := newObjectLayerFn()
	if objectAPI == nil {
		internalLogIf(ctx, errors.New("Callhome: object layer not ready"))
		return
	}

// however returns without bracketing.
func GetSourceIPRaw(r *http.Request) string {
	addr := GetSourceIPFromHeaders(r)
	if addr == "" {
		addr = r.RemoteAddr
	}

	// Default to remote address if headers not set.
	raddr, _, _ := net.SplitHostPort(addr)
	if raddr == "" {
		return addr
	}
	return raddr
}

// GetSourceIP retrieves the IP from the request headers

)

// Env IAM OPA URL
const (
	URL       = "url"
	AuthToken = "auth_token"

	EnvPolicyOpaURL       = "MINIO_POLICY_OPA_URL"
	EnvPolicyOpaAuthToken = "MINIO_POLICY_OPA_AUTH_TOKEN"
)

// DefaultKVS - default config for OPA config
var (
	DefaultKVS = config.KVS{
		config.KV{
			Key:           URL,
			Value:         "",
			HiddenIfEmpty: true,
		},
		config.KV{
			Key:           AuthToken,
			Value:         "",