// max clusters doesn't check kube only, the test may be written in a way that doesn't loop over all of Clusters()
	if t.requiredMaxClusters > 0 && len(t.s.Environment().Clusters()) > t.requiredMaxClusters {
		t.goTest.Skipf("Skipping %q: number of clusters %d is above required max %d",
			t.goTest.Name(), len(t.s.Environment().Clusters()), t.requiredMaxClusters)
		return
	}

	if t.minKubernetesMinorVersion > 0 {
		for _, c := range ctx.Clusters() {

			"MeshConfig are excluded.",
	).Get()

	EnableMCSServiceDiscovery = env.Register(
		"ENABLE_MCS_SERVICE_DISCOVERY",
		false,
		"If enabled, istiod will enable Kubernetes Multi-Cluster "+
			"Services (MCS) service discovery mode. In this mode, service "+
			"endpoints in a cluster will only be discoverable within the "+
			"same cluster unless explicitly exported via ServiceExport.").Get()

  auto clusters = GetClusters(module.get());
  constexpr StringRef kTarget0 = "tpu0";
  EXPECT_EQ(clusters.count(kTarget0), 1);
  EXPECT_EQ(clusters[kTarget0].size(), 1);
  EXPECT_EQ(clusters[kTarget0][0].ops.size(), 2);

  constexpr StringRef kTarget1 = "tpu1";
  EXPECT_EQ(clusters.count(kTarget1), 1);
  EXPECT_EQ(clusters[kTarget1].size(), 1);

	// before running tests.
	DeployEastWestGW bool

	// DumpKubernetesManifests will cause Kubernetes YAML generated by istioctl install/generate to be dumped to artifacts.
	DumpKubernetesManifests bool

	// IstiodlessRemotes makes remote clusters run without istiod, using webhooks/ca from the primary cluster.
	// TODO we could set this per-cluster if istiod was smarter about patching remotes.

	// WorldService is a mock service with `world.default.svc.cluster.local` as
	// a hostname and `10.2.0.0` for ip
	WorldService = MakeService(ServiceArgs{
		Hostname: "world.default.svc.cluster.local",
		Address:  "10.2.0.0",
		ServiceAccounts: []string{
			"spiffe://cluster.local/ns/default/sa/world1",
			"spiffe://cluster.local/ns/default/sa/world2",
		},
		ClusterID: "cluster-2",
	})

		wantErr    bool
	}{
		{
			msg: "a single cluster and single user",
			configTmpl: `
clusters:
- cluster:
    certificate-authority: {{ .CA }}
    server: https://authz.example.com
  name: foobar
users:
- name: a cluster
  user:
    client-certificate: {{ .Cert }}
    client-key: {{ .Key }}
`,
			wantErr: true,
		},
		{
			msg: "multiple clusters with no context",
			configTmpl: `
clusters:

  namespace: istio-system
stringData:
  istio-remote: |
    apiVersion: v1
    clusters:
    - cluster:
        certificate-authority-data: Sis3WWhtcHNI
        server: https://1.2.3.4
      name: gke_istio-test_us-central1-f_istio-remote
    contexts:
    - context:
        cluster: gke_istio-test_us-central1-f_istio-remote
        user: gke_istio-test_us-central1-f_istio-remote

# This configs KinD to spin up a k8s cluster with mixed protocol LB support
# This should be used to create K8s clusters with versions >= 1.20
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
featureGates:
  MixedProtocolLBService: true
  EndpointSlice: true
kubeadmConfigPatches:
  - |
    kind: ClusterConfiguration
    metadata:
      name: config
    etcd:
      local:
        # Run etcd in a tmpfs (in RAM) for performance improvements

apiVersion: v1
clusters:
- cluster:

apiVersion: v1
clusters:
- cluster:
    insecure-skip-tls-verify: true
    server: https://10.96.0.1:443
  name: local
contexts:
- context:
    cluster: local
    user: istio-cni
  name: istio-cni-context
current-context: istio-cni-context
kind: Config
preferences: {}
users:
- name: istio-cni
  user: