retry.UntilSuccess(func() error {
				newWorkloadCert := waitForWorkloadCertUpdate(t, ztunnelPod, sa, istioCtl, originalWorkloadSecret)
				return verifyWorkloadCert(t, newWorkloadCert, newX509)
			}, retry.MaxAttempts(2), retry.Timeout(5*time.Minute))
		})
}

func getWorkloadSecret(t framework.TestContext, zPods []v1.Pod, serviceAccount string, ctl istioctl.Instance) (*configdump.CertsDump, v1.Pod, error) {