func (o *RemoteSecretOptions) prepare(ctx cli.Context) error {
	o.KubeOptions.prepare(ctx)

	if o.ClusterName != "" {
		if !labels.IsDNS1123Label(o.ClusterName) {
			return fmt.Errorf("%v is not a valid DNS 1123 label", o.ClusterName)
		}
	}
	return nil
}

type Warning error

func createRemoteSecret(opt RemoteSecretOptions, client kube.CLIClient) (*v1.Secret, Warning, error) {
	// generate the clusterName if not specified

	}{
		// (0) Should error without a set URL query.
		{
			expected: ErrInvalidQueryParams,
		},
		// (1) Should error on an invalid access key.
		{
			queryParams: map[string]string{
				"Expires":        "60",
				"Signature":      "badsignature",
				"AWSAccessKeyId": "Z7IXGOO6BZ0REAN1Q26I",
			},
			expected: ErrInvalidAccessKeyID,
		},
		// (2) Should error with malformed expires.
		{

		if err == nil {
			if test.error != "" {
				t.Errorf("#%d: %q: expected error %q; got none", i, test.input, test.error)
			}
			continue
		}
		if !strings.Contains(err.Error(), test.error) {
			t.Errorf("#%d: expected error %q; got %q", i, test.error, err)
			continue
		}
	}
}

func runBadTest(i int, test badExprTest, t *testing.T) (err error) {

		if errCode != testCase.errCode {
			t.Errorf("Test %d: Expected error code:%d, got %d", i+1, testCase.errCode, errCode)
		}
		if prefix != testCase.prefix {
			t.Errorf("Test %d: Expected %s, got %s", i+1, testCase.prefix, prefix)
		}
		if token != testCase.token {
			t.Errorf("Test %d: Expected %s, got %s", i+1, testCase.token, token)
		}
		if startAfter != testCase.startAfter {

	set, err := createHostsideProbeIpset(cfg.EnableIPv6)
	if err != nil {
		return nil, fmt.Errorf("error initializing hostside probe ipset: %w", err)
	}

	podNsMap := newPodNetnsCache(openNetnsInRoot(pconstants.HostMountsPath))
	ztunnelServer, err := newZtunnelServer(args.ServerSocket, podNsMap)
	if err != nil {
		return nil, fmt.Errorf("error initializing the ztunnel server: %w", err)
	}

			for i := 0; i < n; i++ {
				if got := hashDeterministicString(m); got != want {
					t.Errorf("hashDeterministicString() = %v, want %v", got, want)
				}
			}
			// Check casual collisions
			if m == nil {
				m = make(map[string]string)
			}
			m["12312312"] = ""
			if got := hashDeterministicString(m); got == want {
				t.Errorf("hashDeterministicString() = %v, does not want %v", got, want)
			}

	}
	for i, tc := range cases {
		tval, err := parseSQLTimestamp(tc.s)
		if err != nil {
			t.Errorf("Case %d: Unexpected error: %v", i+1, err)
			continue
		}
		if !tval.Equal(tc.t) {
			t.Errorf("Case %d: Expected %v got %v", i+1, tc.t, tval)
			continue
		}

		tstr := FormatSQLTimestamp(tc.t)
		if tstr != tc.s {
			t.Errorf("Case %d: Expected %s got %s", i+1, tc.s, tstr)
			continue
		}
	}

		t.Run(tt.name, func(t *testing.T) {
			v := valueBuilders[i]()
			vAlt := altValueBuilders[i]()
			if got := v.CSVString(); got != tt.want {
				t.Errorf("CSVString() = %v, want %v", got, tt.want)
			}
			if got := vAlt.CSVString(); got != tt.wantAlt {
				t.Errorf("CSVString() = %v, want %v", got, tt.wantAlt)
			}
		})
	}
}

func TestValue_bytesToInt(t *testing.T) {
	type fields struct {

		return
	}
	var cReq connectReq
	_, err = cReq.UnmarshalMsg(message.Payload)
	if err != nil {
		writeErr(fmt.Errorf("error parsing connectReq: %w", err))
		return
	}
	remote := m.targets[cReq.Host]
	if remote == nil {
		writeErr(fmt.Errorf("unknown incoming host: %v", cReq.Host))
		return
	}
	if time.Since(cReq.Time).Abs() > 5*time.Minute {

	}

	secret, err := builder.Build()
	if err != nil {
		return []SecretItem{}, fmt.Errorf("error building secret: %v", err)
	}

	return []SecretItem{secret}, nil
}

func secretMetaFromCert(rawCert []byte, trustDomain string) (SecretMeta, error) {
	block, _ := pem.Decode(rawCert)
	if block == nil {
		return SecretMeta{}, fmt.Errorf("failed to parse certificate PEM")
	}
	cert, err := x509.ParseCertificate(block.Bytes)