// Set the default service account if needed
	if len(pod.Spec.ServiceAccountName) == 0 {
		pod.Spec.ServiceAccountName = DefaultServiceAccountName
	}

	serviceAccount, err := s.getServiceAccount(a.GetNamespace(), pod.Spec.ServiceAccountName)
	if err != nil {
		return admission.NewForbidden(a, fmt.Errorf("error looking up service account %s/%s: %w", a.GetNamespace(), pod.Spec.ServiceAccountName, err))
	}

	if err != nil {
		t.Errorf("Unexpected error: %v", err)
	}
	if pod.Spec.ServiceAccountName != DefaultServiceAccountName {
		t.Errorf("Expected service account %s assigned, got %s", DefaultServiceAccountName, pod.Spec.ServiceAccountName)
	}
}

func TestDeniesInvalidServiceAccount(t *testing.T) {
	ns := "myns"

				t.NewSubTest(tc.name).Run(func(t framework.TestContext) {
					if tc.authorizeSidecar {
						serviceAccount := tc.from.Config().ServiceAccountName()
						serviceAccountName := serviceAccount[strings.LastIndex(serviceAccount, "/")+1:]
						authorizeSidecar(t, tc.from.Config().Namespace, serviceAccountName)
					}
					newTLSSidecarDestinationRule(t, apps.External.All, "MUTUAL", tc.drSelector, tc.credentialToUse,

	if err := autoConvert_v1_PodSpec_To_core_PodSpec(in, out, s); err != nil {
		return err
	}

	// We support DeprecatedServiceAccount as an alias for ServiceAccountName.
	// If both are specified, ServiceAccountName (the new field) wins.
	if in.ServiceAccountName == "" {
		out.ServiceAccountName = in.DeprecatedServiceAccount
	}

	// the host namespace fields have to be handled specially for backward compatibility
	// with v1.0.0

            "istio.io/gateway-name" .Name
            "gateway.istio.io/managed" "istio.io-mesh-controller"
          ) | nindent 8}}
    spec:
      terminationGracePeriodSeconds: 2
      serviceAccountName: {{.ServiceAccount | quote}}
      containers:
      - name: istio-proxy
        ports:
        - containerPort: 15021
          name: status-port
          protocol: TCP
        - containerPort: 15090

  - name: istio-certs
    secret:
      optional: true
      {{ if eq .Spec.ServiceAccountName "" }}
      secretName: istio.default
      {{ else -}}
      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
      {{  end -}}
  {{- end }}
    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}

      securityContext:
{{- if not (eq .Values.global.platform "openshift") }}
        runAsUser: 1337
        runAsGroup: 1337
{{- end }}
        runAsNonRoot: true
{{- end }}
      serviceAccountName: {{ $gateway.name }}-service-account
{{- if .Values.global.priorityClassName }}
      priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
{{- if .Values.global.proxy.enableCoreDump }}

      securityContext:
{{- if not (eq .Values.global.platform "openshift") }}
        runAsUser: 1337
        runAsGroup: 1337
{{- end }}
        runAsNonRoot: true
{{- end }}
      serviceAccountName: {{ $gateway.name }}-service-account
{{- if .Values.global.priorityClassName }}
      priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
{{- if .Values.global.proxy.enableCoreDump }}

	NamespaceName() string

	// NamespacedName returns the namespaced name for this service.
	// Short form for Config().NamespacedName().
	NamespacedName() NamespacedName

	// ServiceAccountName returns the service account string for this service.
	ServiceAccountName() string

	// ClusterLocalFQDN returns the fully qualified domain name for cluster-local host.
	ClusterLocalFQDN() string

        {{- toYaml .Values.gateways.securityContext | nindent 8 }}
      {{- else }}
        sysctls:
        - name: net.ipv4.ip_unprivileged_port_start
          value: "0"
      {{- end }}
      serviceAccountName: {{.ServiceAccount | quote}}
      containers:
      - name: istio-proxy
      {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}