// For example,
// ExpandWithTrustDomains({"spiffe://td1/ns/def/sa/def"}, {"td1", "td2"}) returns
//
//	{"spiffe://td1/ns/def/sa/def", "spiffe://td2/ns/def/sa/def"}.
//
// ExpandWithTrustDomains({"spiffe://td1/ns/def/sa/a", "spiffe://td1/ns/def/sa/b"}, {"td2"}) returns
//
//	{"spiffe://td1/ns/def/sa/a", "spiffe://td2/ns/def/sa/a", "spiffe://td1/ns/def/sa/b", "spiffe://td2/ns/def/sa/b"}.

              readOnly: true
            - name: spire-agent-socket-dir
              mountPath: /run/secrets/workload-spiffe-uds
            - name: spire-token
              mountPath: /var/run/secrets/tokens
        # This is the container which runs the SPIFFE CSI driver.
        - name: spiffe-csi-driver
          image: ghcr.io/spiffe/spiffe-csi-driver:0.2.0
          imagePullPolicy: IfNotPresent
          args: [

			trustDomains: []string{
				"foo",
				"cluster.local",
			},
			want: map[string]struct{}{
				"spiffe://cluster.local/ns/def/sa/def": {},
				"spiffe://foo/ns/def/sa/def":           {},
			},
		},
		{
			name:      "TwoIentities",
			spiffeURI: []string{"spiffe://cluster.local/ns/def/sa/def", "spiffe://cluster.local/ns/a/sa/a"},
			trustDomains: []string{

                    principalName:
                      exact: spiffe://principal
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: spiffe://.*principal-suffix
                - authenticated:
                    principalName:
                      prefix: spiffe://principal-prefix
                - authenticated:

		VerifiedIdentity: &spiffe.Identity{Namespace: "istio-system"},
		Type:             model.Router,
		ConfigNamespace:  "istio-system",
	}
	otherNamespace := &model.Proxy{
		Metadata:         &model.NodeMetadata{ClusterID: constants.DefaultClusterName},
		VerifiedIdentity: &spiffe.Identity{Namespace: "other-namespace"},
		Type:             model.Router,

                    principalName:
                      exact: spiffe://principal
                - authenticated:
                    principalName:
                      prefix: spiffe://principal-prefix-
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: spiffe://.*-suffix-principal
                - authenticated:

            - orIds:
                ids:
                - authenticated:
                    principalName:
                      exact: spiffe://rule[0]-from[0]-principal[1]
                - authenticated:
                    principalName:
                      exact: spiffe://rule[0]-from[0]-principal[2]
            - orIds:
                ids:
                - andIds:
                    ids:

                    principalName:
                      exact: spiffe://principal
                - authenticated:
                    principalName:
                      prefix: spiffe://principal-prefix-
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: spiffe://.*-suffix-principal
                - authenticated:

            - orIds:
                ids:
                - authenticated:
                    principalName:
                      exact: spiffe://rule[0]-from[0]-principal[1]
                - authenticated:
                    principalName:
                      exact: spiffe://rule[0]-from[0]-principal[2]
            - orIds:
                ids:
                - metadata:
                    filter: istio_authn

		{
			name:       "Single subject ID",
			subjectIDs: []string{"spiffe://test.com/abc/def"},
			signeeKey:  rsaSigneeKey,
			csrTemplate: &x509.CertificateRequest{
				SignatureAlgorithm: x509.SHA256WithRSA,
				DNSNames:           []string{"name_in_csr"},
				Version:            3,
			},
		},
		{
			name:       "Two subject IDs",
			subjectIDs: []string{"spiffe://test.com/abc/def", "test.com"},
			signeeKey:  rsaSigneeKey,