}
			if err != nil {
				t.Errorf("failed to unescape percent encoded path %s: %v", input, err)
			}
		}
		percentEncodedCases = append(percentEncodedCases, expect{in: input, out: output})
	}
	framework.NewTest(t).
		Run(func(t framework.TestContext) {
			cases := []struct {
				name         string
				ntype        meshconfig.MeshConfig_ProxyPathNormalization_NormalizationType
				expectations []expect
			}{
				{

	"istio.io/istio/pkg/test/scopes"
	"istio.io/istio/pkg/test/shell"
	"istio.io/istio/pkg/test/util/retry"
	"istio.io/istio/tools/istio-iptables/pkg/constants"
)

func TestCNIRaceRepair(t *testing.T) {
	framework.NewTest(t).
		Run(func(t framework.TestContext) {
			if !i.Settings().EnableCNI {
				t.Skip("CNI race condition mitigation is only tested when CNI is enabled.")
			}
			c := t.Clusters().Default()

	componentCloseStart time.Time
	componentCloseEnd   time.Time

	runChildrenParallel bool
	children            []*test
}

func (tst *test) Run(t *testing.T) {
	t.Helper()
	framework.NewTest(t).
		Run(func(t framework.TestContext) {
			t.NewSubTest(tst.name).Run(tst.runInternal)
		})

	if err := tst.doCheck(); err != nil {
		t.Fatal(err)
	}
}

				threshold:           0.0,
				expectedDestination: apps.External.All,
			},
		},
	})
}

func runMirrorTest(t *testing.T, options mirrorTestOptions) {
	framework.
		NewTest(t).
		Run(func(t framework.TestContext) {
			for _, c := range options.cases {
				t.NewSubTest(c.name).Run(func(t framework.TestContext) {
					mirrorHost := options.mirrorHost
					if len(mirrorHost) == 0 {

        given:
        createPassingFailingTest()
        fails("check")
        when:
        renameTests()
        fails("check")
        then:
        testResult.assertTestClassesExecuted('SomeTest', 'NewTest')
    }

    @ToBeFixedForConfigurationCache(bottomSpecs = "XCTestTestFrameworkIntegrationTest")
    def "honors test case filter from --tests flag"() {
        given:
        createPassingFailingTest()

  meshConfig:
    defaultConfig:
      proxyMetadata:
        PROXY_CONFIG_XDS_AGENT: "true"
`
	cfg.ControlPlaneValues = cfgYaml
}

func TestReachability(t *testing.T) {
	framework.NewTest(t).
		Run(func(t framework.TestContext) {
			istioCfg := istio.DefaultConfigOrFail(t, t)
			istioCtl := istioctl.NewOrFail(t, t, istioctl.Config{})
			namespace.ClaimOrFail(t, t, istioCfg.SystemNamespace)

//
//	is used for data plane to control plane TLS authentication.
//
// - Secure naming information is respected in the mTLS handshake.
func TestSecureNaming(t *testing.T) {
	framework.NewTest(t).
		Run(func(t framework.TestContext) {
			istioCfg := istio.DefaultConfigOrFail(t, t)

			testNamespace := apps.EchoNamespace.Namespace
			namespace.ClaimOrFail(t, t, istioCfg.SystemNamespace)

		t.Skip("IngressClass not supported")
	}
}

// TestIngress tests that we can route using standard Kubernetes Ingress objects.
func TestIngress(t *testing.T) {
	framework.
		NewTest(t).
		Run(func(t framework.TestContext) {
			skipIfIngressClassUnsupported(t)
			// Set up secret contain some TLS certs for *.example.com

	"istio.io/istio/pkg/test/scopes"
	"istio.io/istio/pkg/test/util/retry"
)

const deletionTimeout = 5 * time.Minute

func TestReconcileDelete(t *testing.T) {
	framework.
		NewTest(t).
		Run(func(t framework.TestContext) {
			// For positive casse, use minimal profile, iop file will be deleted
			t.NewSubTest("delete-iop-success").Run(func(t framework.TestContext) {

// It uses CredentialName set in DestinationRule API to fetch secrets from k8s API server.
func TestSidecarMutualTlsOrigination(t *testing.T) {
	// nolint: staticcheck
	framework.NewTest(t).
		Run(func(t framework.TestContext) {
			var (
				credNameGeneric  = "mtls-credential-generic"
				fakeCredName     = "fake-mtls-credential"
				credWithCRL      = "mtls-credential-generic-valid-crl"