got := c.pods.getPodsByIP("128.0.0.1")
	assert.Equal(t, got != nil, true)
	assert.Equal(t, map[string]string{"app": "test", "foo": "bar"}, got[0].Labels)

	pod.Labels["foo"] = "not-bar"
	clienttest.Wrap(t, c.podsClient).CreateOrUpdate(pod)
	fx.StrictMatchOrFail(t, xdsfake.Event{
		Type: "proxy",
		ID:   "128.0.0.1",
	},
		xdsfake.Event{
			Type: "xds",
			ID:   "ratings.nsa.svc.company.com",
		})

		return nil, nil, nil, errors.New("tls: NextProtos values too large")
	}

	supportedVersions := config.supportedVersions(roleClient)
	if len(supportedVersions) == 0 {
		return nil, nil, nil, errors.New("tls: no supported versions satisfy MinVersion and MaxVersion")
	}
	maxVersion := config.maxSupportedVersion(roleClient)

	hello := &clientHelloMsg{
		vers:                         maxVersion,

	registerHandlers[*v1.Node](c, c.nodes, "Nodes", c.onNodeEvent, nil)

	c.podsClient = kclient.NewFiltered[*v1.Pod](kubeClient, kclient.Filter{
		ObjectFilter:    kubeClient.ObjectFilter(),
		ObjectTransform: kubelib.StripPodUnusedFields,
	})
	c.pods = newPodCache(c, c.podsClient, func(key types.NamespacedName) {
		c.queue.Push(func() error {
			return c.endpoints.podArrived(key.Name, key.Namespace)

        * requests for a TLS client certificate for any node are approved if the CSR creator has `create` permission on the `certificatesigningrequests` resource and `nodeclient` subresource in the `certificates.k8s.io` API group

        * requests for a TLS client certificate for any node are approved if the CSR creator has `create` permission on the `certificatesigningrequests` resource and `nodeclient` subresource in the `certificates.k8s.io` API group

}

var supportedVersions = []uint16{
	VersionTLS13,
	VersionTLS12,
	VersionTLS11,
	VersionTLS10,
}

// roleClient and roleServer are meant to call supportedVersions and parents
// with more readability at the callsite.
const roleClient = true
const roleServer = false

var tls10server = godebug.New("tls10server")

func (c *Config) supportedVersions(isClient bool) []uint16 {

			return false
		}
	}
	return true
}

func addPods(t *testing.T, controller *FakeController, fx *xdsfake.Updater, pods ...*corev1.Pod) {
	pc := clienttest.Wrap(t, controller.podsClient)
	for _, pod := range pods {
		newPod := pc.CreateOrUpdate(pod)
		setPodReady(newPod)
		// Apiserver doesn't allow Create/Update to modify the pod status. Creating doesn't result in