testCases := []struct {
		check echo.Checker
		from  echo.Instances
		host  string
	}{
		{
			check: check.OK(),
			from:  apps.B,
			host:  "bar.example.com",
		},
		{
			check: check.NotOK(),
			from:  apps.B,
			host:  "bar",
		},
	}
	if t.Settings().EnableDualStack {
		additionalTestCases := []struct {
			check echo.Checker
			from  echo.Instances
			host  string
		}{

										Name: "http",
									},
								}
								if tc.expectSuccess {
									opts.Check = check.And(check.OK(), check.ReachedTargetClusters(t))
								} else {
									opts.Check = check.NotOK()
								}

								a.CallOrFail(t, opts)
							})
					}
				})
			}
		})
}

func verifyCertificatesWithPluginCA(t framework.TestContext, certs []string) {

									if expectMTLS {
										opts.Check = check.And(opts.Check,
											check.MTLSForHTTP())
									}
								} else {
									tpe = "negative"
									opts.Check = check.NotOK()
								}
								include := c.Include
								if include == nil {
									include = func(_ echo.Instance, _ echo.CallOptions) bool { return true }
								}
								if include(from, opts) {

											} else {
												opts.Check = check.And(opts.Check, check.ReachedClusters(t.Clusters(), expectedClusters))
											}
										}
									} else {
										opts.Check = check.NotOK()
									}
									from.CallOrFail(t, opts)
								})
						})
					}
				})
			}
		})
}

type condition func(from echo.Instance, opts echo.CallOptions) bool

									if !src.Config().WaypointClient() && dst.Config().HasAnyWaypointProxy() {
										// TODO currently leads to no L7 processing, in the future it might be denied
										// opt.Check = check.NotOK()
										opt.Check = tcpValidator
									}

									// Only marked to use service waypoint. We'll deny since it's not traversed.
									// Not traversed, since traffic is to-workload IP.

						opts.HTTP.Path = "/valid-token-forward-remote-jwks"
						opts.HTTP.Headers = headers.New().WithAuthz(jwt.TokenIssuer1).Build()
						opts.Check = check.And(
							check.NotOK(),
							check.Status(http.StatusUnauthorized))
					},
				},
			}))

			t.NewSubTest("aud").Run(newTest("testdata/requestauthn/aud.yaml.tmpl", []testCase{
				{
					name: "invalid-aud",

// NOTOC -> dynamic [P8/default]: A P8 compatible, non-PIC stub is generated
// NOTOC -> dynamic [P8/pie]:     A P8 compatible, PIC stub is generated
//
//
// Some notes about other cases:
//   TOC -> TOC, NOTOC -> NOTOC, NOTOC -> TOC  local calls do not require require call stubs.
//   TOC -> NOTOC (R2 is preserved, st_other==0): A special case where a call stub is not needed.

		t.Run(tt.name, func(t *testing.T) {
			v := Value{
				value: tt.fields.value,
			}
			gotVal, gotOk := v.bytesToBool()
			if gotVal != tt.wantVal {
				t.Errorf("bytesToBool() gotVal = %v, want %v", gotVal, tt.wantVal)
			}
			if gotOk != tt.wantOk {
				t.Errorf("bytesToBool() gotOk = %v, want %v", gotOk, tt.wantOk)
			}
		})
	}

			}
			if gotMinorVersion != tt.wantMinorVersion {
				t.Errorf("parseKubeVersion() gotMinorVersion = %v, want %v", gotMinorVersion, tt.wantMinorVersion)
			}
			if gotOk != tt.wantOk {
				t.Errorf("parseKubeVersion() gotOk = %v, want %v", gotOk, tt.wantOk)
			}
		})
	}

				if i > 0 {
					rng.Shuffle(len(tt.m), func(i, j int) {
						tt.m[i], tt.m[j] = tt.m[j], tt.m[i]
					})
				}
				gotSelected, gotOk := tt.m.resolve(&tt.r)
				if gotOk != tt.wantOk {
					t.Errorf("resolve() gotOk = %v, want %v", gotOk, tt.wantOk)
				}
				if gotSelected != nil {
					gotSelected.cached = nil
					gotSelected.reusable = false
				}