t.Errorf("recreating key pair gave different private key on line %d: %x vs %x", lineNo, priv[:], priv2)
		}

		if pubKey2 := priv2.Public().(PublicKey); !bytes.Equal(pubKey, pubKey2) {
			t.Errorf("recreating key pair gave different public key on line %d: %x vs %x", lineNo, pubKey, pubKey2)
		}

		if seed := priv2.Seed(); !bytes.Equal(priv[:32], seed) {

	name string, rewrite bool, wantSuccess bool, openPort bool,
) {
	ctx.Helper()

	var tcpProbe echo.Instance
	cfg := echo.Config{
		Namespace:        ns,
		Service:          name,
		ReadinessTCPPort: "1234",
		Subsets: []echo.SubsetConfig{
			{
				Annotations: map[string]string{annotation.SidecarRewriteAppHTTPProbers.Name: strconv.FormatBool(rewrite)},
			},
		},
	}

	if openPort {
		cfg.Ports = []echo.Port{{

) {
	ctx.Helper()

	var grpcProbe echo.Instance
	cfg := echo.Config{
		Namespace:         ns,
		Service:           name,
		ReadinessGRPCPort: "1234",
		Subsets: []echo.SubsetConfig{
			{
				Annotations: map[string]string{annotation.SidecarRewriteAppHTTPProbers.Name: strconv.FormatBool(rewrite)},
			},
		},
	}

	if openPort {
		cfg.Ports = []echo.Port{{

			// Override hostname to match the SAN in the cert we are using
			// TODO(nmittler): We should probably make this the same as ExternalHostname
			Hostname: "server.default.svc",
		},
		Subsets: []echo.SubsetConfig{
			{
				Version:     "v1",
				Annotations: map[string]string{annotation.SidecarInject.Name: "false"},
			},
		},
	}
	if t.Settings().EnableDualStack {
		config.IPFamilies = "IPv6, IPv4"

	cfg := echo.Config{
		Namespace: ns,
		Service:   name,
		Ports: []echo.Port{{
			Name:         "http-8080",
			Protocol:     protocol.HTTP,
			ServicePort:  8080,
			WorkloadPort: 8080,
		}},
		Subsets: []echo.SubsetConfig{
			{
				Annotations: map[string]string{annotation.SidecarRewriteAppHTTPProbers.Name: strconv.FormatBool(rewrite)},
			},
		},
	}

		ctx.NewSubTestf("to %s", strings.Join(toNames, " ")).Run(func(ctx framework.TestContext) {
			testFn(ctx, svc)
		})
	}
}

// nDestinations splits the given deployments into subsets of size n. A deployment may be present in multiple subsets to
// ensure every deployment is included.
func nDestinations(ctx framework.TestContext, n int, deployments echo.Services) (out []echo.Services) {
	nDests := len(deployments)
	if nDests < n {

			for _, ns := range namespaces {
				builder = builder.WithConfig(echo.Config{
					Service:   ns.revision,
					Namespace: ns.namespace,
					Ports:     ports.All(),
					Subsets:   []echo.SubsetConfig{{}},
				})
			}
			instances := builder.BuildOrFail(t)
			// Add our existing revision to the instances list
			instances = append(instances, apps.A...)
			testAllEchoCalls(t, instances)
		})

func reachableNakedDestinations(from echo.Instance) match.Matcher {
	srcNw := from.Config().Cluster.NetworkName()
	excluded := match.And(
		// Only exclude naked if all subsets are naked. If an echo instance contains a mix of
		// subsets with and without sidecars, we'll leave it up to the test to determine what
		// is reachable.
		match.AllNaked,

// only be used if hasKMA is true.
type gcmKMA struct {
	gcmAsm
}

// flags for the KMA instruction
const (
	kmaHS      = 1 << 10 // hash subkey supplied
	kmaLAAD    = 1 << 9  // last series of additional authenticated data
	kmaLPC     = 1 << 8  // last series of plaintext or ciphertext blocks
	kmaDecrypt = 1 << 7  // decrypt
)

		"ServiceAccount":          cfg.ServiceAccount,
		"DisableAutomountSAToken": cfg.DisableAutomountSAToken,
		"AppContainers":           appContainers,
		"ContainerPorts":          containerPorts,
		"Subsets":                 cfg.Subsets,
		"TLSSettings":             cfg.TLSSettings,
		"Cluster":                 cfg.Cluster.Name(),
		"ReadinessTCPPort":        cfg.ReadinessTCPPort,
		"ReadinessGRPCPort":       cfg.ReadinessGRPCPort,