if i > 0 && keyID != keyIDs[i-1] {
			sameKeyID = false
		}
	}
	if sameKeyID {
		contexts := make([]kms.Context, 0, len(keyIDs))
		for i := range buckets {
			contexts = append(contexts, kms.Context{buckets[i]: path.Join(buckets[i], objects[i])})
		}
		unsealKeys, err := k.DecryptAll(ctx, keyIDs[0], kmsKeys, contexts)
		if err != nil {
			return nil, err
		}
		keys := make([]ObjectKey, len(unsealKeys))

		configAccess := clientcmd.NewDefaultPathOptions()
		configAccess.GlobalFile = o.Kubeconfig
		if config, err := configAccess.GetStartingConfig(); err == nil {
			if context, ok := config.Contexts[config.CurrentContext]; ok && context.Namespace != "" {
				o.Namespace = context.Namespace
			}
		}
	}

  name: {cluster}
contexts:
- context:
    cluster: {cluster}
    user: {cluster}
  name: {cluster}
current-context: {cluster}
kind: Config
preferences: {}
users:
- name: {cluster}
  user:
    token: token
`, "{cluster}", fakeClusterName)

	cases := []struct {
		name               string
		clusterName        string
		context            string
		server             string

  schedule:
    # cron every week on monday
    - cron: "0 0 * * 1"

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - name: Dump GitHub context
        env:
          GITHUB_CONTEXT: ${{ toJson(github) }}
        run: echo "$GITHUB_CONTEXT"
      - uses: actions/checkout@v4
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

	// by the key ID. The context must match the context value
	// used to generate the ciphertext.
	DecryptKey(keyID string, ciphertext []byte, context Context) ([]byte, error)

	// DecryptAll decrypts all ciphertexts with the key referenced
	// by the key ID. The contexts must match the context value
	// used to generate the ciphertexts.
	DecryptAll(ctx context.Context, keyID string, ciphertext [][]byte, context []Context) ([][]byte, error)

type Logger interface {
	LogOnceIf(ctx context.Context, err error, id string, errKind ...interface{})
	LogIf(ctx context.Context, err error, errKind ...interface{})
}

// RefreshKey checks the validity of the KMS Master Key
func (c *kesClient) RefreshKey(ctx context.Context, logger Logger) bool {
	c.lock.RLock()
	defer c.lock.RUnlock()

	validKey := false

func setCaller(ctx context.Context, cl *RemoteClient) context.Context {
	return context.WithValue(ctx, ctxCallerKey{}, cl)
}

func setSubroute(ctx context.Context, s string) context.Context {
	return context.WithValue(ctx, ctxSubrouteKey{}, s)
}

// StreamTypeHandler is a type safe handler for streaming requests.
type StreamTypeHandler[Payload, Req, Resp RoundTripper] struct {
	WithPayload bool

	// Override the default capacities (1)

}

// Set server def with timeout.
TF_CAPI_EXPORT extern void TFE_ContextSetServerDefWithTimeout(
    TFE_Context* ctx, int keep_alive_secs, const void* proto, size_t proto_len,
    int64_t init_timeout_in_ms, TF_Status* status,
    bool clear_existing_contexts) {
  TFE_ContextSetServerDefWithTimeoutAndRetries(
      ctx, keep_alive_secs, proto, proto_len, init_timeout_in_ms,

func remoteSecretNameFromClusterName(clusterName string) string {
	return remoteSecretPrefix + clusterName
}

// NewCreateRemoteSecretCommand creates a new command for joining two contexts
// together in a multi-cluster mesh.
func NewCreateRemoteSecretCommand(ctx cli.Context) *cobra.Command {
	opts := RemoteSecretOptions{
		AuthType:         RemoteSecretAuthTypeBearerToken,
		AuthPluginConfig: make(map[string]string),

	}

	const contextName = "istio-cni-context"
	const clusterName = "local"
	const userName = "istio-cni"
	kcfg := &api.Config{
		Kind:        "Config",
		APIVersion:  "v1",
		Preferences: api.Preferences{},
		Clusters: map[string]*api.Cluster{
			clusterName: cluster,
		},
		AuthInfos: map[string]*api.AuthInfo{
			userName: {
				Token: string(token),
			},
		},
		Contexts: map[string]*api.Context{
			contextName: {