fetch := kubetest.NewSinglePodFetch(t.Clusters().Default(),
						revTagNs.Name(),
						fmt.Sprintf("app=%s", "revision-tag"))
					pods, err := fetch()
					if err != nil {
						t.Fatalf("error fetching pods: %v", err)
					}

					verifyRevision(t, istioCtl, pods[0].Name, revTagNs.Name(), tc.revision)
				})
			}
		})
}

			Optional:    true,
			Type:        "string",
		},
		config.HelpKV{
			Key:         ClaimUserinfo,
			Description: `Enable fetching claims from UserInfo Endpoint for authenticated user` + defaultHelpPostfix(ClaimUserinfo),
			Optional:    true,
			Type:        "on|off",
		},
		config.HelpKV{
			Key:         KeyCloakRealm,

	test.TestWatch(
		validNewStatefulSet(),
		// matching labels
		[]labels.Set{
			{"a": "b"},
		},
		// not matching labels
		[]labels.Set{
			{"a": "c"},
			{"foo": "bar"},
		},

		// matching fields
		[]fields.Set{
			{"metadata.name": "foo"},
		},
		// not matching fields
		[]fields.Set{
			{"metadata.name": "bar"},
		},
	)
}

            }
        }
        1 * adapter.builder(Void) >> builder
        1 * builder.build('result') >> 'the result'
    }

    def "adapts implementation-specific cancellation failure when fetching model"() {
        def parameters = Stub(ConsumerOperationParameters)
        def failure = new GradleException("broken", new BuildCancelledException("cancelled."))

        when:

	test.TestWatch(
		validNewReplicaSet(),
		// matching labels
		[]labels.Set{
			{"a": "b"},
		},
		// not matching labels
		[]labels.Set{
			{"a": "c"},
			{"foo": "bar"},
		},
		// matching fields
		[]fields.Set{
			{"status.replicas": "5"},
			{"metadata.name": "foo"},
			{"status.replicas": "5", "metadata.name": "foo"},
		},
		// not matching fields
		[]fields.Set{

.PHONY: fetch-root-ca
rawcluster := $(shell kubectl config current-context)
cluster := $(subst /,-,$(rawcluster))
pwd := $(shell pwd)
export KUBECONFIG

fetch-root-ca:
	@echo "fetching root ca from k8s cluster: "$(cluster)""
	@mkdir -p $(pwd)/$(cluster)
	@res=$$(kubectl get secret istio-ca-secret -n $(ISTIO_NAMESPACE) >/dev/null 2>&1; echo $$?); \
	if [ $$res -eq 1 ]; then \

    return moduleOp.emitOpError()
           << "error in fetching TPU_SYSTEM devices: "
           << status_or_system_devices.status().message();
  auto status_or_tpu_devices =
      GetTPUDevices(device_names, status_or_system_devices.value());
  if (!status_or_tpu_devices.ok())
    return moduleOp.emitOpError() << "error in fetching TPU devices: "

)

// fakeKeyring is a fake docker auth config keyring
type fakeKeyring struct {
	auth []credentialprovider.AuthConfig
	ok   bool
}

// Lookup implements the DockerKeyring method for fetching credentials based on image name.
// Returns fake results based on the auth and ok fields in fakeKeyring
func (f *fakeKeyring) Lookup(image string) ([]credentialprovider.AuthConfig, bool) {
	return f.auth, f.ok
}

	).Get()

	JwksFetchMode = func() jwt.JwksFetchMode {
		v := env.Register(
			"PILOT_JWT_ENABLE_REMOTE_JWKS",
			"false",
			"Mode of fetching JWKs from JwksUri in RequestAuthentication. Supported value: "+
				"istiod, false, hybrid, true, envoy. The client fetching JWKs is as following: "+
				"istiod/false - Istiod; hybrid/true - Envoy and fallback to Istiod if JWKs server is external; "+
				"envoy - Envoy.",
		).Get()

        1 * handler.onFailure(!null) >> {args -> wrappedFailure = args[0] }
        wrappedFailure.message.contains(Exceptions.INCOMPATIBLE_VERSION_HINT)
        wrappedFailure.cause.is(failure)
    }

    def "fetching model does not block"() {
        GradleProject result = Mock()
        ResultHandler<GradleProject> handler = Mock()

        given:
        asyncConnection.run(!null, !null) >> { args ->