tc.from.Config().Namespace)
					callOpt := newTLSSidecarCallOpts(apps.External.All[0], host, tc.expectedResponse)
					tc.from[0].CallOrFail(t, callOpt)
				})
			}
		})
}

// Authorize only specific sidecars in the namespace with secret listing permissions.

												// TODO use echotest to generate the cases that would work for multi-network + naked
												t.Skip("https://github.com/istio/istio/issues/37307")
											}

											from.CallOrFail(t, opts)
										})
								}
							}
						}
					})
				}
			}
		})
	}
}

// Exclude calls from naked->VM since naked has no Envoy

	// Setup default check. This is done here rather than in echo core package to avoid import loops
	if opts.Check == nil {
		opts.Check = check.OK()
	}
	return c.aggregateResponses(opts)
}

func (c *instance) CallOrFail(t test.Failer, opts echo.CallOptions) echo.CallResult {
	t.Helper()
	r, err := c.Call(opts)
	if err != nil {
		t.Fatal(err)
	}
	return r
}

	framework.
		NewTest(t).
		Run(func(t framework.TestContext) {
			client, to := setupEcho(t, mode)

			for _, tc := range cases {
				t.NewSubTest(tc.Name).Run(func(t framework.TestContext) {
					client.CallOrFail(t, echo.CallOptions{
						To:    to,
						Count: 1,
						Port: echo.Port{
							Name: tc.PortName,
						},
						HTTP: echo.HTTP{
							HTTP2:   tc.HTTP2,

										return fmt.Errorf("expected to be handled by gateway. response: %s", r)
									}
									return nil
								})),
						}

						internalClient[0].CallOrFail(t, opts)
					})
			}
		})
}

const (
	// Destination Rule configs
	DestinationRuleConfigSimple = `
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:

func (f fakeInstance) Clusters() cluster.Clusters {
	panic("implement me")
}

func (f fakeInstance) Call(echo.CallOptions) (echo.CallResult, error) {
	panic("implement me")
}

func (f fakeInstance) CallOrFail(test.Failer, echo.CallOptions) echo.CallResult {
	panic("implement me")
}

func (f fakeInstance) UpdateWorkloadLabel(add map[string]string, remove []string) error {
	panic("implement me")
}

												opts.Check = check.And(opts.Check, check.ReachedClusters(t.Clusters(), expectedClusters))
											}
										}
									} else {
										opts.Check = check.NotOK()
									}
									from.CallOrFail(t, opts)
								})
						})
					}
				})
			}
		})
}

type condition func(from echo.Instance, opts echo.CallOptions) bool

func not(c condition) condition {

	}

	if callType == Mtls {
		opts.TLS.Key = tlsCtx.PrivateKey
		opts.TLS.Cert = tlsCtx.Cert
	}

	// Certs occasionally take quite a while to become active in Envoy, so retry for a long time (2min)
	ing.CallOrFail(ctx, opts)
}

// RotateSecrets deletes kubernetes secrets by name in credNames and creates same secrets using key/cert
// from ingressCred.