}

	dryDB := DB.Session(&gorm.Session{DryRun: true})
	r := dryDB.Distinct("u.id, u.*").Table("user_speaks as s").Joins("inner join users as u on u.id = s.user_id").Where("s.language_code ='US' or s.language_code ='ES'").Find(&User{})
	if !regexp.MustCompile(`SELECT DISTINCT u\.id, u\.\* FROM user_speaks as s inner join users as u`).MatchString(r.Statement.SQL.String()) {
		t.Fatalf("Build Distinct with u.*, but got %v", r.Statement.SQL.String())
	}

		sealingKey   [32]byte
		encryptedKey bytes.Buffer
	)
	mac := hmac.New(sha256.New, extKey)
	mac.Write(iv[:])
	mac.Write([]byte(domain))
	mac.Write([]byte(SealAlgorithm))
	mac.Write([]byte(path.Join(bucket, object))) // use path.Join for canonical 'bucket/object'
	mac.Sum(sealingKey[:0])
	if n, err := sio.Encrypt(&encryptedKey, bytes.NewReader(key[:]), sio.Config{Key: sealingKey[:], CipherSuites: fips.DARECiphers()}); n != 64 || err != nil {

					// Write delayed CNI config file
					data, err := os.ReadFile(filepath.Join("testdata", c.delayedConfName))
					if err != nil {
						t.Fatal(err)
					}
					err = os.WriteFile(filepath.Join(tempDir, c.delayedConfName), data, 0o644)
					if err != nil {
						t.Fatal(err)
					}
					t.Logf("delayed write to %v", filepath.Join(tempDir, c.delayedConfName))
				} else if len(c.expectedConfName) > 0 {

	k8sServicePort = "443"
	kubeCAFilepath = "testdata/kube-ca.crt"
	saToken        = "service_account_token_string"
)

func TestCreateValidKubeconfigFile(t *testing.T) {
	tmp := t.TempDir()
	os.WriteFile(filepath.Join(tmp, "token"), []byte(saToken), 0o644)
	constants.ServiceAccountPath = tmp
	cases := []struct {
		name               string
		expectedFailure    bool
		k8sServiceProtocol string
		k8sServiceHost     string

	tmpDir := t.TempDir()
	tmpCharts := chartSourceType(filepath.Join(tmpDir, operatorSubdirFilePath))
	err := copyDir(string(liveCharts), string(tmpCharts))
	if err != nil {
		t.Fatal(err)
	}

	rs, err := readFile(filepath.Join(testDataDir, "input-extra-resources", testResourceFile+".yaml"))
	if err != nil {
		t.Fatal(err)
	}

		out[cmd] = objs
	}

	return out, nil
}

// fakeApplyManifest runs istioctl install.
func fakeApplyManifest(inFile, flags string, chartSource chartSourceType) (*ObjectSet, error) {
	inPath := filepath.Join(testDataDir, "input", inFile+".yaml")
	manifest, err := runManifestCommand("install", []string{inPath}, flags, chartSource, nil)
	if err != nil {
		return nil, fmt.Errorf("error %s: %s", err, manifest)
	}

		t.Fatalf("Unexpected output for 'istioctl %s'\n got: %q\nwant: %q", strings.Join(c.args, " "), output, c.expectedOutput)
	}

	if c.expectedString != "" && !strings.Contains(output, c.expectedString) {
		t.Fatalf("Output didn't match for '%s %s'\n got %v\nwant: %v", cmd.Name(), strings.Join(c.args, " "), output, c.expectedString)
	}

	if c.wantException {
		if fErr == nil {

			}

			if r.JoinTable != nil {
				if r.JoinTable.Name != relation.JoinTable.Name {
					t.Errorf("schema %v relation's join table name expects %v, but got %v", s, relation.JoinTable.Name, r.JoinTable.Name)
				}

				if r.JoinTable.Table != relation.JoinTable.Table {
					t.Errorf("schema %v relation's join table tablename expects %v, but got %v", s, relation.JoinTable.Table, r.JoinTable.Table)
				}

}

func (md metricDisplay) String() string {
	return fmt.Sprintf("Name: %s\nType: %s\nHelp: %s\nLabels: {%s}\n", md.Name, md.Type, md.Help, strings.Join(md.Labels, ","))
}

func (md metricDisplay) TableRow() string {
	labels := strings.Join(md.Labels, ",")
	if labels == "" {
		labels = ""
	} else {
		labels = "`" + labels + "`"
	}

)

var (
	extendedClient kube.CLIClient
	kubeClient     client.Client
)

// TODO: rewrite this with running the actual top level command.
func TestOperatorDump(t *testing.T) {
	goldenFilepath := filepath.Join(env.IstioSrc, "operator/cmd/mesh/testdata/operator/output/operator-dump.yaml")

	odArgs := &operatorDumpArgs{
		common: operatorCommonArgs{
			hub:               "foo.io/istio",
			tag:               "1.2.3",