assertThat(client.connectionPool.connectionCount()).isEqualTo(1)
  }

  /** Test a previously coalesced connection that's no longer healthy.  */
  @Test
  fun staleCoalescedConnection() {
    server.enqueue(MockResponse())
    server.enqueue(MockResponse())
    val connection = AtomicReference<Connection?>()
    client =
      client
        .newBuilder()

    with client:
        response = client.get("/a/override")
    assert response.content == b"Hello A"
    assert response.headers["content-type"] == text_type


def test_router_a_a():
    with client:
        response = client.get("/a/a")
    assert response.json() == {"msg": "Hello A A"}
    assert response.headers["content-type"] == json_type


def test_router_a_a_override():
    with client:

    client = DummyClient()
    yield client
    await client.close()


Client = Annotated[DummyClient, Depends(get_client)]


@pytest.fixture(name="client")
def client_fixture() -> TestClient:
    app = FastAPI()

    @app.get("/")
    async def get_people(client: Client) -> list:
        return await client.get_people()

    client = TestClient(app)
    return client

    val reversed = ConnectionSpec.COMPATIBLE_TLS.cipherSuites!!.reversed()
    val client =
      makeClient(
        ConnectionSpec.COMPATIBLE_TLS,
        TlsVersion.TLS_1_2,
        reversed,
      )

    makeRequest(client)

    val expectedConnectionCipherSuites = expectedConnectionCipherSuites(client)
    // Will choose a poor cipher suite but not plaintext.

      .build()

  @JvmStatic
  fun providers(
    client: OkHttpClient,
    http2Only: Boolean,
    workingOnly: Boolean,
    getOnly: Boolean,
  ): List<DnsOverHttps> =
    buildList {
      add(buildGoogle(client))
      if (!getOnly) {
        add(buildGooglePost(client))
      }
      add(buildCloudflare(client))
      add(buildCloudflareIp(client))
      if (!getOnly) {

    .build();
```

Client Authentication
---------------------

The above scenario is representative of most TLS set ups: the client uses certificates to validate
the identity of a server. The converse is also possible. Here we create a server that authenticates
a client and a client that authenticates a server.

```java
// Create the root for client and server to trust. We could also use different roots for each!

### Client Binaries

filename | sha512 hash
-------- | -----------
[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.29.15/kubernetes-client-darwin-amd64.tar.gz) | 54a99fd8ffe5d3d6d41f13bf1fb973d57a7c7420587af114be1db41b6347e444ccf02cd98914d9a0c365ff3f7131de2b5fcf3edcfa3e5ad1e57eee9e7db1a524

        .message("Intercepted!")
        .body("abc".toResponseBody("text/plain; charset=utf-8".toMediaType()))
        .build()
    client =
      client
        .newBuilder()
        .addInterceptor(Interceptor { chain: Interceptor.Chain? -> interceptorResponse })
        .build()
    val response = client.newCall(request).execute()
    assertThat(response).isSameInstanceAs(interceptorResponse)
  }

  @Test

### Client Binaries

filename | sha512 hash
-------- | -----------
[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.30.14/kubernetes-client-darwin-amd64.tar.gz) | 6ad7da5929458e9ed7c1e396fc862a14df67d8b7cbae336e05149af42b2e466eeec30dd0251d96ce49fe55a2a0cc854d1d93b27be9aaeb3d1b42dd916b83ae06

4. Import the node certificate in the client's keystore:
   `keytool -import -alias test-node -keystore test-client.jks -storepass keypass -file test-node.crt -noprompt`
5. Export the client's certificate:
   `keytool -export -alias test-client -keystore test-client.jks -storepass keypass -file test-client.crt`
6. Import the client certificate in the node's keystore: