Name: "https",
								},
								Address: to.Config().Service,
								Scheme:  s,
							}
							opts.Check = check.And(check.OK(), check.ReachedTargetClusters(t))

							from.CallOrFail(t, opts)
						})
					}

					client := match.Cluster(cluster).FirstOrFail(t, client)
					cases := []struct {
						from   echo.Instance
						to     echo.Instances
						expect bool
					}{
						{

			t.ConfigIstio().Eval(ns, args, DestinationRuleConfigIstioMutual).ApplyOrFail(t, apply.Wait)

			client := apps.EchoNamespace.A[0]
			server := apps.EchoNamespace.B[0]
			client.CallOrFail(t, echo.CallOptions{
				To: server,
				Port: echo.Port{
					Name: "http",
				},
				Count: 1,
				Check: check.OK(),
			})

			certPEMs := cert.DumpCertFromSidecar(t, client, server, "http")

					check.RequestHeader("X-Forwarded-Client-Cert", ExpectedXfccHeader)),
				Retry: echo.Retry{
					Options: []retry.Option{retry.Delay(5 * time.Second), retry.Timeout(1 * time.Minute)},
				},
			}

			client[0].CallOrFail(t, opts)
		})
}

const (
	DestinationRuleConfigMutual = `
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: server
  namespace: {{.AppNamespace}}
spec:

					opts := echo.CallOptions{
						To: to,
						Port: echo.Port{
							Name: "http",
						},
					}
					opts.Check = check.And(check.OK(), check.ReachedTargetClusters(t))

					from.CallOrFail(t, opts)
				})

			// step 1: Update CA root cert with combined root
			if err := cert.CreateCustomCASecret(t,
				"ca-cert.pem", "ca-key.pem",
				"cert-chain.pem", "root-cert-combined.pem"); err != nil {

							opts := echo.CallOptions{
								To: to,
								Port: echo.Port{
									Name: "http",
								},
							}
							opts.Check = check.And(check.OK(), check.ReachedTargetClusters(t))
							a.CallOrFail(t, opts)
						})

					secureNamingTestCases := []struct {
						name            string
						destinationRule string
						expectSuccess   bool
					}{
						{

				if r.IP == ip {
					found = true
				}
			}
			if !found {
				return fmt.Errorf("unexpected IP %s, expected to be contained in %v",
					r.IP, expected)
			}
		}

		return nil
	}
	_ = from.CallOrFail(t, echo.CallOptions{
		To: to,
		Port: echo.Port{
			Name: "http",
		},
		Count: 1,
		Check: checker,
	})

							opts := echo.CallOptions{
								To: to,
								Port: echo.Port{
									Name: "http",
								},
							}

							c.customizeCall(t, from, &opts)

							from.CallOrFail(t, opts)
						})
				})
			}
		})

					test.setup(t)
					for _, source := range sources {
						source := source
						t.NewSubTest(source.Config().Cluster.StableName()).RunParallel(func(t framework.TestContext) {
							source.CallOrFail(t, echo.CallOptions{
								To: to,
								Port: echo.Port{
									Name: "http",
								},
								Check: check.And(
									check.OK(),

					from:       apps.NS[2].B,
					to:         apps.NS[0].B,
				},
			}

			for _, tc := range testCases {
				t.NewSubTest(tc.name).Run(func(t framework.TestContext) {
					tc.from[0].CallOrFail(t, echo.CallOptions{
						To: tc.to,
						Port: echo.Port{
							Protocol:    protocol.HTTP,
							ServicePort: 80,
						},
						Check: check.And(
							check.ErrorOrStatus(tc.statusCode),

	})
	if err != nil {
		return err
	}
	return nil
}

func SendTrafficOrFail(t test.Failer, from echo.Instance) {
	from.CallOrFail(t, echo.CallOptions{
		To: GetTarget(),
		Port: echo.Port{
			Name: "http",
		},
		Check: check.OK(),
	})
	from.CallOrFail(t, echo.CallOptions{
		To: apps.Naked,
		Port: echo.Port{
			Name: "http",
		},
		Retry: echo.Retry{
			NoRetry: true,
		},