Text: EnvoyTextLogFormat + " %REQ_WITHOUT_QUERY(key1:val1)% REQ_WITHOUT_QUERY(key2:val1)% %METADATA(UPSTREAM_HOST:istio)% %METADATA(CLUSTER:istio)%",
					Labels: &structpb.Struct{
						Fields: map[string]*structpb.Value{
							"key1": {Kind: &structpb.Value_StringValue{StringValue: "%METADATA(CLUSTER:istio)%"}},
							"key2": {Kind: &structpb.Value_StringValue{StringValue: "%REQ_WITHOUT_QUERY(key1:val1)%"}},

		},
		{
			name: "@request.auth.claims[key1][key2]",
			want: RoutingClaim{Match: true, Separator: Square, Claims: []string{"key1", "key2"}},
		},
		{
			name: "@request.auth.claims[key1][KEY2]",
			want: RoutingClaim{Match: true, Separator: Square, Claims: []string{"key1", "KEY2"}},
		},
		{
			name: "@request.auth.claims[key1] [key2]",
			want: RoutingClaim{Match: true, Separator: Square, Claims: []string{"key1] [key2"}},

          endpoint: unix:///tmp/testprovider.sock
      - identity: {}
      - secretbox:
          keys:
            - name: key1
              secret: YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY=
      - aesgcm:
          keys:
            - name: key1
              secret: c2VjcmV0IGlzIHNlY3VyZQ==
            - name: key2

				cacheLenEquals(t, cache, 1)
				cache.set(key1, twi2)
				cacheLenEquals(t, cache, 1)

				got11 := cache.get(info1, key1)
				twiPtrEquals(t, nil, got11)

				got21 := cache.get(info2, key1)
				twiPtrEquals(t, twi2, got21)

				got12 := cache.get(info1, key2)
				twiPtrEquals(t, nil, got12)

				got22 := cache.get(info2, key2)
				twiPtrEquals(t, nil, got22)
			},
		},
	}

          name: testproviderv2
          endpoint: unix:///tmp/testprovider.sock
      - aescbc:
          keys:
            - name: key1
              secret: c2VjcmV0IGlzIHNlY3VyZQ==
            - name: key2
              secret: dGhpcyBpcyBwYXNzd29yZA==
      - secretbox:
          keys:
            - name: key1

      - secretbox:
          keys:
            - name: key1
              secret: YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY=
      - aescbc:
          keys:
            - name: key1
              secret: c2VjcmV0IGlzIHNlY3VyZQ==
            - name: key2
              secret: dGhpcyBpcyBwYXNzd29yZA==
      - identity: {}
      - aesgcm:
          keys:
            - name: key1

resources:
  - resources:
      - secrets
    providers:
      - secretbox:
          keys:
            - name: key1
              secret: YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY=
      - aescbc:
          keys:
            - name: key1
              secret: c2VjcmV0IGlzIHNlY3VyZQ==
            - name: key2
              secret: dGhpcyBpcyBwYXNzd29yZA==
      - kms:
          name: testprovider

        then:
        result == expectedResult
        1 * onAccess.accept(key1, reportedValue1)
        1 * onAccess.accept(key2, reportedValue2)
        0 * onAccess._

        where:
        key1       | reportedValue1  | key2           | reportedValue2 | expectedResult
        'existing' | 'existingValue' | 'other'        | 'otherValue'   | true

apiVersion: apiserver.config.k8s.io/v1
resources:
  - resources:
      - secrets
    providers:
      - aesgcm:
          keys:
            - name: key1
              secret: c2VjcmV0IGlzIHNlY3VyZQ==
            - name: key2
              secret: dGhpcyBpcyBwYXNzd29yZA==
      - secretbox:
          keys:
            - name: key1
              secret: YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY=
      - kms:
          name: testprovider

      - secretbox:
          keys:
            - name: key1
              secret: YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY=
      - aescbc:
          keys:
            - name: key1
              secret: c2VjcmV0IGlzIHNlY3VyZQ==
            - name: key2
              secret: dGhpcyBpcyBwYXNzd29yZA==
      - identity: {}
      - aesgcm:
          keys:
            - name: key1