func (s *CredentialsController) insertCache(user string, response error) {
	s.mu.Lock()
	defer s.mu.Unlock()
	key := authorizationKey(user)
	expDelta := cacheTTL
	if response == nil {
		// Cache success a bit longer, there is no need to quickly revoke access
		expDelta *= 5
	}
	log.Debugf("cached authorization for user %s: %v", user, response)
	s.authorizationCache[key] = authorizationResponse{

			reviewResponse = wh.inject(ar, path)
		}
	}

	response := kube.AdmissionReview{}
	response.Response = reviewResponse
	var responseKube runtime.Object
	var apiVersion string
	if ar != nil {
		apiVersion = ar.APIVersion
		response.TypeMeta = ar.TypeMeta
		if response.Response != nil {
			if ar.Request != nil {
				response.Response.UID = ar.Request.UID
			}
		}
	}

		ResponseNonce: eres.Nonce,
	})
	// We should get a response
	eres3 := ads.ExpectResponse(t)
	// Now send our CDS request
	ads.RequestResponseAck(t, &discovery.DiscoveryRequest{
		TypeUrl:       v3.ClusterType,
		ResponseNonce: eres.Nonce,
	})
	// Send another request. This is essentially an ACK of eres3. However, envoy expects a response
	ads.RequestResponseAck(t, &discovery.DiscoveryRequest{

		log.Printf("[HTTP][allowed]: %s", l)
		response.Header().Set(resultHeader, resultAllowed)
		response.Header().Set(overrideHeader, request.Header.Get(overrideHeader))
		response.Header().Set(receivedHeader, l)
		response.WriteHeader(http.StatusOK)
	} else {
		log.Printf("[HTTP][denied]: %s", l)
		response.Header().Set(resultHeader, resultDenied)
		response.Header().Set(overrideHeader, request.Header.Get(overrideHeader))

		cacheLog.Errorf("%s failed to extract expire time from server certificate in CSR response %+v: %v",
			logPrefix, certChainPEM, err)
		return nil, fmt.Errorf("failed to extract expire time from server certificate in CSR response: %v", err)
	}

	cacheLog.WithLabels("latency", time.Since(t0), "ttl", time.Until(expireTime)).Info("generated new workload certificate")

	if isRedirect(response.StatusCode) { // Redirect
		// In other cases, we return the original status code. For redirects, it is illegal to
		// not have Location header, so we need to switch to just 200.
		w.WriteHeader(http.StatusOK)
		return
	}
	// We only write the status code to the response.
	w.WriteHeader(response.StatusCode)
	// Return the body from probe as well
	b, _ := k8sUtilIo.ReadAtMost(response.Body, maxRespBodyLength)

							"",
						},
					},
				},
			}},
		}, valid: false},
		{name: "empty header name - response add", route: &networking.HTTPRoute{
			Route: []*networking.HTTPRouteDestination{{
				Destination: &networking.Destination{Host: "foo.baz"},
				Headers: &networking.Headers{
					Response: &networking.Headers_HeaderOperations{
						Add: map[string]string{
							"": "value",
						},
					},
				},

		// s1:5005 outbound, bind=true
		// :443 - https external, bind=false
		// 10.11.0.1_7070, bind=true -> inbound|2000|s1 - on port 7070, fwd to 37070
		// virtual
		if len(adscon.GetTCPListeners()) == 0 {
			t.Fatal("No response")
		}

		for _, s := range []string{"lds_tcp", "lds_http", "rds", "cds", "ecds"} {
			want, err := os.ReadFile(wd + "/none_" + s + ".json")
			if err != nil {
				t.Fatal(err)
			}

					WorkloadName:      "name3",
					ClusterId:         testC,
				},
			},
		},
	}})
	s.assertEvent(t, s.wleXdsName("name2"))
	s.assertEvent(t, s.wleXdsName("name3"))

	// Non-existent IP should have no response
	s.assertWorkloads(t, s.addrXdsName("10.0.0.1"), workloadapi.WorkloadStatus_HEALTHY)
	s.clearEvents()

	s.addService(t, "svc1", map[string]string{}, // labels
		map[string]string{}, // annotations
		[]int32{80},

			return fmt.Errorf("expected %d buckets, got %v", expectedBuckets, totalBuckets)
		}
		return nil
	}, retry.Delay(time.Second), retry.Timeout(time.Second*20))
}

// TestGRPCCountMetrics tests that istio_[request/response]_messages_total are present https://github.com/istio/istio/issues/44144
// Kiali depends on these metrics
func TestGRPCCountMetrics(t *testing.T) {
	framework.NewTest(t).