}
	}

	var secrets map[string][]byte
	if len(wasmSecrets) > 0 {
		// Generate the pull secrets first, which will be used when populating the extension config.
		if e.secretController != nil {
			var err error
			secretController, err := e.secretController.ForCluster(proxy.Metadata.ClusterID)
			if err != nil {
				log.Warnf("proxy %s is from an unknown cluster, cannot retrieve certificates for Wasm image pull: %v", proxy.ID, err)

)

var k8sControllerLog = log.RegisterScope("secretcontroller", "Citadel kubernetes controller log")

// CaSecretController manages the self-signed signing CA secret.
type CaSecretController struct {
	client corev1.CoreV1Interface
}

// NewCaSecretController returns a pointer to a newly constructed SecretController instance.
func NewCaSecretController(core corev1.CoreV1Interface) *CaSecretController {
	cs := &CaSecretController{
		client: core,

	ecdsGen := &xds.EcdsGenerator{ConfigGenerator: cg}
	if env.CredentialsController != nil {
		generators[v3.SecretType] = xds.NewSecretGen(env.CredentialsController, s.Cache, clusterID, env.Mesh())
		ecdsGen.SetCredController(env.CredentialsController)
	}
	generators[v3.ExtensionConfigurationType] = ecdsGen
	generators[v3.NameTableType] = &xds.NdsGenerator{ConfigGenerator: cg}