regex: spiffe://.*/ns/foo/sa/rule[0]-from[1]-principal[0]
                - authenticated:
                    principalName:
                      exact: spiffe://td1/ns/foo/sa/rule[0]-from[1]-principal[1]
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: spiffe://.*bar/ns/foo/sa/rule[0]-from[1]-principal[1]

            - orIds:
                ids:
                - authenticated:
                    principalName:
                      exact: spiffe://rule[0]-from[0]-principal[1]
                - authenticated:
                    principalName:
                      exact: spiffe://rule[0]-from[0]-principal[2]
            - orIds:
                ids:
                - andIds:
                    ids:

                    principalName:
                      exact: spiffe://principal
                - authenticated:
                    principalName:
                      prefix: spiffe://principal-prefix-
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: spiffe://.*-suffix-principal
                - authenticated:

			name:          "Principal in wrong format with SPIFFE:// prefix",
			principal:     "spiffe://cluster.local/ns/foo/sa/bar",
			out:           "",
			expectedError: "wrong SPIFFE format: spiffe://cluster.local/ns/foo/sa/bar",
		},
		{
			name:          "Principal in wrong format with less components",
			principal:     "sa/test-sa/ns/default",
			out:           "",
			expectedError: "wrong SPIFFE format: sa/test-sa/ns/default",
		},
		{

- `cert-chain-alt-2.pem`: alternative certificate chain signed by `root-cert-alt.pem`.
- `workload-foo-[cert|key].pem`: workload certificate and key for URI SAN `spiffe://trust-domain-foo/ns/foo/sa/foo` signed by `ca-cert.key`.
- `workload-bar-[cert|key].pem`: workload certificate and key for URI SAN `spiffe://trust-domain-bar/ns/bar/sa/bar` signed by `ca-cert.key`.
- `workload-foo-root-certs.pem`: root and intermediate CA certificates for foo workload certificate.

            - orIds:
                ids:
                - authenticated:
                    principalName:
                      exact: spiffe://rule[0]-from[0]-principal[1]
                - authenticated:
                    principalName:
                      exact: spiffe://rule[0]-from[0]-principal[2]
            - orIds:
                ids:
                - metadata:
                    filter: istio_authn

	"time"

	networking "istio.io/api/networking/v1alpha3"
	"istio.io/istio/pilot/pkg/model"
	"istio.io/istio/pkg/config"
	"istio.io/istio/pkg/config/labels"
	"istio.io/istio/pkg/config/schema/gvk"
	"istio.io/istio/pkg/spiffe"
	"istio.io/istio/pkg/test/util/assert"
)

var GlobalTime = time.Now()

// ServiceEntry with a selector
var selector = &config.Config{
	Meta: config.Meta{
		GroupVersionKind:  gvk.ServiceEntry,

metadata:
  name: "service-b-dr"
spec:
  host: "b.NS.svc.cluster.local"
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
      subjectAltNames:
      - "spiffe://cluster.local/ns/NS/sa/a"
      - "spiffe://cluster.local/ns/NS/sa/b"
      - "spiffe://cluster.local/ns/default/sa/default"
      - "I-do-not-exist"
`
)

// TestSecureNaming verifies:

            memory: 1Gi
          requests:
            cpu: 100m
            memory: 128Mi
        volumeMounts:
        - mountPath: /var/run/secrets/workload-spiffe-uds
          name: workload-socket
        - mountPath: /var/run/secrets/workload-spiffe-credentials
          name: workload-certs
        - mountPath: /var/run/secrets/istio
          name: istiod-ca-cert
        - mountPath: /var/lib/istio/data

		{
			name:       "Single subject ID",
			subjectIDs: []string{"spiffe://test.com/abc/def"},
			signeeKey:  rsaSigneeKey,
			csrTemplate: &x509.CertificateRequest{
				SignatureAlgorithm: x509.SHA256WithRSA,
				DNSNames:           []string{"name_in_csr"},
				Version:            3,
			},
		},
		{
			name:       "Two subject IDs",
			subjectIDs: []string{"spiffe://test.com/abc/def", "test.com"},
			signeeKey:  rsaSigneeKey,