"client-ca-file":                     string(someRandomCA),
						"requestheader-username-headers":     `["alfa","bravo","charlie"]`,
						"requestheader-group-headers":        `["delta"]`,
						"requestheader-extra-headers-prefix": `["echo","foxtrot"]`,
						"requestheader-client-ca-file":       string(anotherRandomCA),
						"requestheader-allowed-names":        `["first","second"]`,
					},
				},
			},

				"--requestheader-username-headers=X-Remote-User",
				"--requestheader-group-headers=X-Remote-Group",
				"--requestheader-extra-headers-prefix=X-Remote-Extra-",
				"--requestheader-client-ca-file=" + filepath.Join(testCertsDir, "front-proxy-ca.crt"),
				"--requestheader-allowed-names=front-proxy-client",
				"--authorization-mode=Node,RBAC",

						opts.HTTP.Path = "/valid-token-noauthz"
						opts.HTTP.Headers = headers.New().WithAuthz(jwt.TokenIssuer1).Build()
						opts.Check = check.And(
							check.OK(),
							check.ReachedTargetClusters(t),
							check.RequestHeaders(map[string]string{
								headers.Authorization: "",
								"X-Test-Payload":      payload1,
								"X-Jwt-Iss":           "******@****.***",
								"X-Jwt-Iat":           "1562182722",
							}))
					},

			if handlerCalls != 1 || authnCalls != 1 {
				t.Errorf("unexpected calls: handlerCalls=%d, authnCalls=%d", handlerCalls, authnCalls)
			}

			want := testcase.finalHeaders
			if want == nil && testcase.requestHeaders != nil {
				want = http.Header{}
			}
			if diff := cmp.Diff(want, testcase.requestHeaders); len(diff) > 0 {

    return sslSocket
  }

  override fun onStream(stream: Http2Stream) {
    try {
      val requestHeaders = stream.takeHeaders()
      var path: String? = null
      var i = 0
      val size = requestHeaders.size
      while (i < size) {
        if (requestHeaders.name(i) == Header.TARGET_PATH_UTF8) {
          path = requestHeaders.value(i)
          break
        }
        i++
      }
      if (path == null) {

	allErrors := []error{}

	if err := checkForWhiteSpaceOnly("requestheader-username-headers", s.UsernameHeaders...); err != nil {
		allErrors = append(allErrors, err)
	}
	if err := checkForWhiteSpaceOnly("requestheader-group-headers", s.GroupHeaders...); err != nil {
		allErrors = append(allErrors, err)
	}
	if err := checkForWhiteSpaceOnly("requestheader-extra-headers-prefix", s.ExtraHeaderPrefixes...); err != nil {

		authenticationConfigMapName,
		"requestheader-client-ca-file",
		client)
	if err != nil {
		return nil, fmt.Errorf("unable to create DynamicCAFromConfigMap controller: %v", err)
	}

	requestHeaderAuthRequestController := headerrequest.NewRequestHeaderAuthRequestController(
		authenticationConfigMapName,
		authenticationConfigMapNamespace,
		client,
		"requestheader-username-headers",
		"requestheader-group-headers",

func NewAWS(ipv6 bool) Environment {
	headers := requestHeaders(ipv6)

	return &awsEnv{
		region:           getRegion(ipv6, headers),
		availabilityZone: getAvailabilityZone(ipv6, headers),
		instanceID:       getInstanceID(ipv6, headers),
	}
}

func requestHeaders(ipv6 bool) map[string]string {
	// try to get token first, if it fails, fallback to IMDSv1

   *
   * @param streamId server-initiated stream ID: an even number.
   * @param requestHeaders minimally includes `:method`, `:scheme`, `:authority`,
   * and `:path`.
   */
  fun onRequest(
    streamId: Int,
    requestHeaders: List<Header>,
  ): Boolean

  /**
   * The response headers corresponding to a pushed request.  When [last] is true, there are

   *     Corresponds to `FLAG_FIN`.
   */
  @Throws(IOException::class)
  fun newStream(
    requestHeaders: List<Header>,
    out: Boolean,
  ): Http2Stream {
    return newStream(0, requestHeaders, out)
  }

  @Throws(IOException::class)
  private fun newStream(
    associatedStreamId: Int,
    requestHeaders: List<Header>,
    out: Boolean,
  ): Http2Stream {
    val outFinished = !out