} else {
			t.Logf("no potential policy bypass requests found")
		}

	default:
		t.Fatalf("unknown fuzzer %s", fuzzer)
	}
}

func TestFuzzAuthorization(t *testing.T) {
	framework.NewTest(t).
		Run(func(t framework.TestContext) {
			ns := "fuzz-authz"
			namespace.ClaimOrFail(t, t, ns)

			t.ConfigIstio().YAML(ns, authzDenyPolicy).ApplyOrFail(t)
			t.Logf("authorization policy applied")

	"gateway-conformance-app-backend",
	"gateway-conformance-web-backend",
	"gateway-conformance-mesh",
}

var skippedTests = map[string]string{}

func TestGatewayConformance(t *testing.T) {
	framework.
		NewTest(t).
		Run(func(ctx framework.TestContext) {
			// Precreate the GatewayConformance namespaces, and apply the Image Pull Secret to them.
			if ctx.Settings().Image.PullSecret != "" {
				for _, ns := range conformanceNamespaces {

// It uses CredentialName set in DestinationRule API to fetch secrets from k8s API server
func TestSimpleTlsOrigination(t *testing.T) {
	// nolint: staticcheck
	framework.NewTest(t).
		RequiresSingleNetwork(). // https://github.com/istio/istio/issues/37134
		Run(func(t framework.TestContext) {
			var (
				credName        = "tls-credential-cacert"
				fakeCredName    = "fake-tls-credential-cacert"

// - works for both HTTP and TCP protocol
// - works for pass through filter chains
func TestTrustDomainValidation(t *testing.T) {
	framework.NewTest(t).Run(
		func(ctx framework.TestContext) {
			testNS := apps.EchoNamespace.Namespace

			ctx.ConfigIstio().YAML(testNS.Name(), fmt.Sprintf(policy, testNS.Name())).ApplyOrFail(ctx)

			trustDomains := map[string]struct {

// should test all possible revisioned namespace pairings to test traffic between all versions
func TestMultiVersionRevision(t *testing.T) {
	// nolint: staticcheck
	framework.NewTest(t).
		RequiresSingleCluster().
		RequiresLocalControlPlane().
		// Requires installation of CPs from manifests, won't succeed
		// if existing CPs have different root cert
		Label(label.CustomSetup).

        A: "1"
        B: "2"
      `
		})).
		Run()
}

type proxyConfigInstance struct {
	namespace string
	config    string
}

func TestProxyConfig(t *testing.T) {
	framework.NewTest(t).
		RequireIstioVersion("1.13").
		Run(func(ctx framework.TestContext) {
			ns := namespace.NewOrFail(ctx, ctx, namespace.Config{
				Prefix: "pc-test",
				Inject: true,
			})
			cases := []struct {

// Each case tests a different way of using local resources to reach remote destination(s).
func TestWorkloadEntryGateway(t *testing.T) {
	// nolint: staticcheck
	framework.NewTest(t).
		RequiresMinClusters(2).
		Run(func(t framework.TestContext) {
			crd.DeployGatewayAPIOrSkip(t)
			i := istio.GetOrFail(t, t)
			type gwAddr struct {
				ip   string
				port int
			}

	case "service":
		return "Service", "\"\"", targetName
	default:
		return "", "", ""
	}
}

func TestWasmPluginConfigurations(t *testing.T) {
	framework.NewTest(t).
		Run(func(t framework.TestContext) {
			testCases := []struct {
				desc         string
				name         string
				testHostname string
				targetType   string
				targetName   string
			}{
				{

		name string

		mediaType  string
		out        []byte
		outErrs    []error
		req        *http.Request
		statusCode int
		object     runtime.Object

		wantCode    int
		wantHeaders http.Header
	}
	newTest := func() test {
		return test{
			name:      "compress on gzip",
			out:       largePayload,
			mediaType: "application/json",
			req: &http.Request{
				Header: http.Header{
					"Accept-Encoding": []string{"gzip"},

	"istio.io/istio/pkg/test/util/retry"
	"istio.io/istio/security/pkg/pki/util"
	"istio.io/istio/tests/integration/security/util/cert"
)

func TestIntermediateCertificateRefresh(t *testing.T) {
	framework.NewTest(t).
		Run(func(t framework.TestContext) {
			t.Skip("https://github.com/istio/istio/issues/49648")
			istioCfg := istio.DefaultConfigOrFail(t, t)
			istioCtl := istioctl.NewOrFail(t, t, istioctl.Config{})