}
	return func() {
		ctx.ConfigIstio().YAML(ist.Settings().SystemNamespace, con).DeleteOrFail(ctx)
	}
}

func sendTrafficAndCheckIfRatelimited(t framework.TestContext) {
	t.Helper()
	clt.CallOrFail(t, echo.CallOptions{
		To: srv,
		Port: echo.Port{
			Name: "http",
		},
		Count: 5,
		Check: check.TooManyRequests(),
	})

		HTTP: echo.HTTP{
			Path:   "/path",
			Method: "GET",
		},
		Count: 1,
		Retry: echo.Retry{
			Options: append(defaultOptions, options...),
		},
		Check: checker,
	}

	_ = cltInstance.CallOrFail(ctx, httpOpts)
}

func sendTrafficToHostname(ctx framework.TestContext, checker echo.Checker, hostname string, options ...retry.Option) {
	ctx.Helper()
	if len(GetClientInstances()) == 0 {

)

// DumpCertFromSidecar gets the certificates served by the destination.
func DumpCertFromSidecar(t test.Failer, from echo.Instance, to echo.Target, port string) []string {
	result := from.CallOrFail(t, echo.CallOptions{
		To:    to,
		Count: 1,
		Port: echo.Port{
			Name: port,
		},
		Scheme: scheme.TLS,
		TLS: echo.TLS{
			Alpn: []string{"istio"},
		},
		Check: check.NoError(),
	})

										Key:  trustDomains[td].key,
									},
									Check: check.OK(),
								}
							}
							if !allow {
								opt.Check = check.ErrorContains("tls: unknown certificate")
							}
							from.CallOrFail(t, opt)
						})
					}

					// Request using plaintext should always allowed.
					verify(t, client, "plaintext", httpPlaintext, scheme.HTTP, true)

					for _, src := range apps.A.Instances() {
						src := src
						// TODO possibly can run parallel
						t.NewSubTestf("from %s", src.Clusters().Default().Name()).Run(func(t framework.TestContext) {
							src.CallOrFail(t, echo.CallOptions{
								// check that we lb to all the networks (we won't reach non-config clusters because of the topology.istio.io/cluster selector)

					newTLSGatewayTest(t).
						Run(func(t framework.TestContext, from echo.Instance, to echo.Target) {
							callOpt := newTLSGatewayCallOpts(to, host, tc.statusCode, tc.useGateway)
							from.CallOrFail(t, callOpt)
						})
				})
			}
		})
}

// TestMutualTlsOrigination test MUTUAL TLS mode with TLS origination happening at Gateway proxy

									checker := check.URL(expected.out)
									if expected.out == "400" {
										checker = check.Status(http.StatusBadRequest)
									}
									from.CallOrFail(t, echo.CallOptions{
										To:    to,
										Count: 1,
										HTTP: echo.HTTP{
											Path: expected.in,
										},
										Port: echo.Port{
											Name: "http",
										},

	}

	return addrs
}

func (c *ingressImpl) Call(options echo.CallOptions) (echo.CallResult, error) {
	return c.callEcho(options)
}

func (c *ingressImpl) CallOrFail(t test.Failer, options echo.CallOptions) echo.CallResult {
	t.Helper()
	resp, err := c.Call(options)
	if err != nil {
		t.Fatal(err)
	}
	return resp
}

								},
								HTTP: echo.HTTP{
									Headers: headers.New().WithHost(c.host).Build(),
								},
								Check: check.And(check.NoError(), check.Status(wantCode)),
							}
							from.CallOrFail(t, opts)
						})
					}
				})
		})
}

func TestAuthz_NotMethod(t *testing.T) {
	// NOTE: negative match for mtls is tested by TestAuthz_DenyPlaintext.

									mtlsString = "plaintext"
								}
								testName := fmt.Sprintf("%s/%s(%s)", mtlsString, p.Name, allow)
								t.NewSubTest(testName).Run(func(t framework.TestContext) {
									from.CallOrFail(t, opts)
								})
							}
						})
				})
			}
		})