NotAfter:  time.Now().Add(time.Hour),
		NotBefore: time.Now().Add(-time.Hour),
	}
	expectedErr := "x509: serial number must be positive"
	_, err = CreateCertificate(rand.Reader, tmpl, tmpl, k.Public(), k)
	if err == nil || err.Error() != expectedErr {
		t.Errorf("CreateCertificate returned unexpected error: want %q, got %q", expectedErr, err)
	}
}

const dupExtCert = `-----BEGIN CERTIFICATE-----

		return true
	}
	_, networkSet := gwLabels[label.TopologyNetwork.Name]
	if !networkSet {
		return false
	}
	expectedPort := "15443"
	if port, f := gwLabels[label.NetworkingGatewayPort.Name]; f {
		expectedPort = port
	}
	return fmt.Sprint(l.Port) == expectedPort
}

func hasListenerMode(l v1beta1.Listener, mode string) bool {

	c := &Conn{conn: &discardConn{}, config: testConfig.Clone()}

	expectedErr := "tls: server sent certificate containing RSA key larger than 8192 bits"
	err := c.verifyServerCertificate([][]byte{testCert.Bytes})
	if err == nil || err.Error() != expectedErr {
		t.Errorf("Conn.verifyServerCertificate unexpected error: want %q, got %q", expectedErr, err)
	}

	expectedErr = "tls: client sent certificate containing RSA key larger than 8192 bits"

		}
		return expectedRootBytes
	}

	expectedCerts := concatCerts(string(rootCert), string(caClientRootCert))
	// Ensure that contents of the rootCert are correct.
	checkSecret(t, sc, security.RootCertReqResourceName, security.SecretItem{
		ResourceName: security.RootCertReqResourceName,
		RootCert:     expectedCerts,
	})

	// Add Duplicates
	sc.UpdateConfigTrustBundle(expectedCerts)

		expectedHint   framework.QueueingHint
		expectedErr    bool
	}{
		"skip-deletes": {
			pod:          podWithClaimTemplate,
			oldObj:       allocatedClaim,
			newObj:       nil,
			expectedHint: framework.QueueSkip,
		},
		"backoff-wrong-new-object": {
			pod:         podWithClaimTemplate,
			newObj:      "not-a-claim",
			expectedErr: true,
		},
		"skip-wrong-claim": {

	if err != nil {
		t.Fatal(err)
	}

	t.Run("leaf", func(t *testing.T) {
		opts := VerifyOptions{}
		expectedErr := "invalid leaf certificate"
		_, err = badCert.Verify(opts)
		if err == nil || err.Error() != expectedErr {
			t.Fatalf("unexpected error: want %q, got %q", expectedErr, err)
		}
	})

	goodCert, err := certificateFromPEM(googleLeaf)
	if err != nil {
		t.Fatal(err)
	}

		expectedHint                    framework.QueueingHint
		expectedErr                     bool
	}{
		"backoff-wrong-old-object": {
			pod:                             &v1.Pod{},
			oldObj:                          "not-a-pod",
			enableInPlacePodVerticalScaling: true,
			expectedHint:                    framework.Queue,
			expectedErr:                     true,
		},
		"backoff-wrong-new-object": {

		desc            string
		requestBody     io.Reader
		limit           int64
		expectedMetrics string
		expectedErr     bool
	}{
		{
			desc:            "aaaa with limit 1",
			requestBody:     strings.NewReader("aaaa"),
			limit:           1,
			expectedMetrics: "",
			expectedErr:     true,
		},
		{
			desc:        "aaaa with limit 5",
			requestBody: strings.NewReader("aaaa"),

		expected           bool
		expectedErr        string
	}{
		{
			m:                  v1.VolumeMount{Name: "rw"},
			runtimeSupportsRRO: true,
			expected:           false,
			expectedErr:        "",
		},
		{
			m:                  v1.VolumeMount{Name: "ro", ReadOnly: true},
			runtimeSupportsRRO: true,
			expected:           false,
			expectedErr:        "",
		},
		{

		proxy           *model.Proxy
		defaultEndpoint string
		expectedAddr    string
		expectedPort    uint32
	}{
		// ipv4 use cases
		{
			name:            "ipv4 host: defaultEndpoint set to 127.0.0.1:7073",
			proxy:           ipv4Proxy,
			defaultEndpoint: "127.0.0.1:7073",
			expectedAddr:    "127.0.0.1",
			expectedPort:    7073,
		},
		{
			name:            "ipv4 host: defaultEndpoint set to [::1]:7073",