// Check that the CA certificate in the configmap of each namespace is as expected, which
			// is used for data plane to control plane TLS authentication.
			retry.UntilSuccessOrFail(t, func() error {
				return checkCACert(t, testNamespace)
			}, retry.Delay(time.Second), retry.Timeout(10*time.Second))
			to := match.Namespace(testNamespace).GetMatches(apps.EchoNamespace.B)
			for _, cluster := range t.Clusters() {

DOWNLOAD_COMMAND=""
function set_download_command () {
  # Try curl.
  if command -v curl > /dev/null; then
    if curl --version | grep Protocols  | grep https > /dev/null; then
      DOWNLOAD_COMMAND="curl -fLSs --retry 5 --retry-delay 1 --retry-connrefused"
      return
    fi
    echo curl does not support https, will try wget for downloading files.
  else
    echo curl is not installed, will try wget for downloading files.
  fi

			f.t.Fatalf("failed to create config %v: %v", cfg.Name, err)
		}
	}

	// TODO allow passing event handlers for controller

	retry.UntilOrFail(f.t, f.store.HasSynced, retry.Delay(time.Millisecond))
	retry.UntilOrFail(f.t, f.Registry.HasSynced, retry.Delay(time.Millisecond))

	f.ServiceEntryRegistry.ResyncEDS()
}

							return fmt.Errorf("got %v full and %v partial, expected %v full and %v partial", full, partial, expectedFull, expectedPartial)
						}
						return nil
					}
				}, retry.Timeout(opts.DebounceAfter*8), retry.Delay(opts.DebounceAfter/2))
				if err != nil {
					t.Error(err)
				}
			}

			// Send updates
			tt.test(updateCh, expect)

			close(stopCh)
			wg.Wait()
		})
	}

import (
	"fmt"
	"sync"
	"testing"

	"go.uber.org/atomic"

	"istio.io/istio/pkg/log"
	"istio.io/istio/pkg/slices"
	"istio.io/istio/pkg/test/util/assert"
)

func TestLazySerial(t *testing.T) {
	t.Run("retry", func(t *testing.T) {
		computations := atomic.NewInt32(0)
		l := NewWithRetry(func() (int32, error) {
			res := computations.Inc()
			if res > 2 {
				return res, nil
			}

			return res, fmt.Errorf("not yet")

			return err
		}
		err := retry.UntilSuccess(func() error {
			_, err := c.Kube().CoreV1().ServiceAccounts(n.name).Patch(context.TODO(),
				"default",
				types.JSONPatchType,
				[]byte(`[{"op": "add", "path": "/imagePullSecrets", "value": [{"name": "test-gcr-secret"}]}]`),
				metav1.PatchOptions{})
			return err
		}, retry.Delay(1*time.Second), retry.Timeout(10*time.Second))
		if err != nil {
			return err

			Meta: config.Meta{
				GroupVersionKind: gvk.HTTPRoute,
				Name:             "another",
			},
		})
		if err != nil {
			t.Fatal(err)
		}

		retry.UntilOrFail(t, handled.Load, retry.Timeout(time.Second))
	})
}

func schemaFor(kind, proto string) resource.Schema {
	return resource.Builder{
		Kind:   kind,
		Plural: strings.ToLower(kind) + "s",
		Proto:  proto,

const (
	TokenExchange = "token_exchange"
	CSR           = "csr"
)

var NumOutgoingRetries = monitoring.NewSum(
	"num_outgoing_retries",
	"Number of outgoing retry requests (e.g. to a token exchange server, CA, etc.)",

					fmt.Println(err)
					return err
				}
			}
			return nil
		}, retry.Timeout(3*time.Second))
	})
}

func (w *workload) testWeighted(t *testing.T, s *xds.FakeDiscoveryServer) {
	if w.weightedExpectations == nil {
		return
	}
	t.Run("weighted", func(t *testing.T) {
		// wait for eds cache update
		retry.UntilSuccessOrFail(t, func() error {

  // Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.
  // This requires no RBAC privilege, but will require the CNI agent to run as a privileged pod.
  bool repairPods = 11;

  // No longer used.
  string createEvents = 6 [deprecated = true];