t.Cleanup(func() {
				app.Uninstall(t, app.NginxExternalMTLS(ns.MeshExternal))
				oc.DeleteSecret(t, meshNamespace, "nginx-client-certs", "nginx-ca-certs")
				oc.DeleteFromTemplate(t, ns.Bookinfo, nginxTlsIstioMutualGateway, smcp)
				oc.DeleteFromString(t, meshNamespace, nginxServiceEntry, originateMtlsToNginx)
				// revert patch to istio-egressgateway
				oc.TouchSMCP(t, meshNamespace, smcp.Name)
				// TODO: this is a potential bug; investigate why the following is necessary
				// ingressgateway needs to be restarted or it will continue reporting the following error:
				// error	cache	resource:file-root:/etc/istio/nginx-ca-certs/example.com.crt failed to generate secret for proxy from file: open /etc/istio/nginx-ca-certs/example.com.crt: no such file or directory
				oc.DeletePod(t, pod.MatchingSelector("app=istio-ingressgateway", meshNamespace))
			})