controller, err := NewTokensController(informers.Core().V1().ServiceAccounts(), informers.Core().V1().Secrets(), client, TokensControllerOptions{TokenGenerator: generator, RootCA: []byte("CA Data"), MaxRetries: tc.MaxRetries})
			if err != nil {
				t.Fatalf("error creating Tokens controller: %v", err)
			}

			if tc.ExistingServiceAccount != nil {

				// This check ensures we do not. If this is failing, check to ensure the bootstrap config matches
				// the XDS response.
				t.Fatalf("found unexpected secrets, should have only default and ROOTCA: %v", output)
			}
		})
}

func jsonUnmarshallOrFail(t test.Failer, context, s string) any {
	t.Helper()
	var val any

	// this is guarded by prettyPrint

                              }
                            ]
                          },
                          "validation_context_sds_secret_config": {
                            "name": "ROOTCA",
                            "sds_config": {
                              "api_config_source": {
                                "api_type": "GRPC",
                                "grpc_services": [

               {
                "prefix": "spiffe://cluster.local/"
               }
              ]
             },
             "validation_context_sds_secret_config": {
              "name": "ROOTCA",
              "sds_config": {
               "api_config_source": {
                "api_type": "GRPC",
                "grpc_services": [
                 {
                  "envoy_grpc": {

			},
			want: MergedPeerAuthentication{
				Mode: model.MTLSPermissive,
			},
		},
		{
			name: "ignore non-emptypb selector in root namespace",
			configs: []*config.Config{
				{
					Meta: config.Meta{
						Name:      "default",
						Namespace: "root-namespace",
					},
					Spec: &v1beta1.PeerAuthentication{
						Selector: &type_beta.WorkloadSelector{
							MatchLabels: map[string]string{

env GOPATH=$WORK/gopath/src/shadow/root1${:}$WORK/gopath/src/shadow/root2

# The math in root1 is not "math" because the standard math is.
go list -f '({{.ImportPath}}) ({{.ConflictDir}})' ./shadow/root1/src/math
stdout '^\(.*(\\|/)src(\\|/)shadow(\\|/)root1(\\|/)src(\\|/)math\) \('$GOROOT'(\\|/)?src(\\|/)math\)$'

# The foo in root1 is "foo".
go list -f '({{.ImportPath}}) ({{.ConflictDir}})' ./shadow/root1/src/foo
stdout '^\(foo\) \(\)$'

        name: tls
        number: 9080
        protocol: %s
      tls:
        mode: MUTUAL
        privateKey: "httpbinkey.pem"
        serverCertificate: "httpbin.pem"
        caCertificates: "rootCA.pem"
  workloadSelector:
    labels:
      app: foo
---
`, protocol)
	}
	expectedTLSContext := func(filterChain *listener.FilterChain) error {
		tlsContext := &tls.DownstreamTlsContext{}

        """

        when:
        execute(rootBuild, ':root1:compileJava')

        then:
        result.assertTasksExecuted(':root2:compileJava', ':buildA:compileJava', ':root1:compileJava')

        and:
        canRunFromCache(rootBuild, ':root1:compileJava')
    }

    def "can depend back on root build and back on an included build"() {
        given:

                regularFile("root1/one", 0x1234)
            ]),
            directory("root2", [
                regularFile("root2/one", 0x1234),
                regularFile("root2/two", 0x2345)
            ])
        ) == [added("root2/two")]
    }

    def "deep removal"() {
        expect:
        changes(
            directory("root", [
                regularFile("root/one", 0x1234),

        formatter.node("child2")
        formatter.endChildren()

        then:
        formatter.toString() == toPlatformLineSeparators("""root1:
  - child1
  - child2
root2: child1
root3:
  - child1
  - child2""")
    }

    def "can append to root node"() {
        when:
        formatter.node("Some ")
        formatter.append("thing")
        formatter.append(".")

        then: