// Verify that GatewayAPI CRD creation is forbidden.
			for i := range testCRDs {
				if err := wait.PollUntilContextTimeout(context.Background(), 2*time.Second, 30*time.Second, false, func(ctx context.Context) (bool, error) {
					if err := tc.kclient.Create(ctx, testCRDs[i]); err != nil {
						if kerrors.IsAlreadyExists(err) {
							// VAP was disabled and re-enabled at the beginning of the test.
							// It may take some time for the API server to process this change and register the VAP.
							// As a result, we might encounter a "CRD X already exists" error.
							// To handle this, we allow the API server some time to catch up.
							t.Logf("Failed to create CRD %q: %v; retrying...", testCRDs[i].Name, err)
							return false, nil
						}
						if !strings.Contains(err.Error(), tc.expectedErrMsg) {
							return false, fmt.Errorf("unexpected error received while creating CRD %q: %v", testCRDs[i].Name, err)
						}
						return true, nil
					}
					return false, fmt.Errorf("admission error is expected while creating CRD %q but not received", testCRDs[i].Name)
				}); err != nil {
					t.Errorf("failed to verify VAP protection for creating gateway API CRD %q: %v", testCRDs[i].Name, err)
				}

						if !strings.Contains(err.Error(), tc.expectedErrMsg) {
							return false, fmt.Errorf("unexpected error received while creating CRD %q: %v", testCRDs[i].Name, err)