currentTgt, ok := oldTargets[i].(*http.Target)
		if !ok {
			continue
		}
		var newTgt *http.Target

		for ii := range tgts {
			if currentTgt.Name() == tgts[ii].Name() {
				newTgt = tgts[ii]
				currentTgt.AssignMigrateTarget(newTgt)
				http.CreateOrAdjustGlobalBuffer(currentTgt, newTgt)
				break
			}
		}
	}

	for _, t := range tgts {
		err := t.Init(ctx)
		if err != nil {

	}
	return []grpc.DialOption{
		// nolint: gosec
		// Only runs over istioctl experimental
		// TODO: https://github.com/istio/istio/issues/41937
		grpc.WithTransportCredentials(credentials.NewTLS(
			&tls.Config{
				// Always skip verifying, because without it we always get "certificate signed by unknown authority".
				// We don't set the XDSSAN for the same reason.
				InsecureSkipVerify: true,
			})),

	if err != nil {
		return nil, fmt.Errorf("failed to get application default credentials: %w", err)
	}

	return []grpc.DialOption{
		grpc.WithTransportCredentials(credentials.NewTLS(&tls.Config{
			RootCAs:    systemRoots,
			MinVersion: tls.VersionTLS12,
		})),
		grpc.WithPerRPCCredentials(&meshAuthCredentials{
			k8sCreds: k8sCreds,
			gcpCreds: gcpCreds,
			project:  gcpProject,