ServerCertificate: "server-cert.crt",
					PrivateKey:        "private-key.key",
					CaCertificates:    "ca-cert.crt",
				},
			},
			result: &auth.DownstreamTlsContext{
				CommonTlsContext: &auth.CommonTlsContext{
					AlpnProtocols: util.ALPNHttp,
					TlsCertificateSdsSecretConfigs: []*auth.SdsSecretConfig{
						{
							Name: "file-cert:server-cert.crt~private-key.key",

    "${CERT_DIR}/pki/ca.crt" \
    "${CERT_DIR}/pki/issued/${MASTER_NAME}.crt" \
    "${CERT_DIR}/pki/private/${MASTER_NAME}.key" \
    "${CERT_DIR}/pki/issued/kubelet.crt" \
    "${CERT_DIR}/pki/private/kubelet.key" \
    "${CERT_DIR}/pki/issued/kubecfg.crt" \
    "${CERT_DIR}/pki/private/kubecfg.key" \
    "${CERT_DIR}/pki/issued/kube-apiserver.crt" \
    "${CERT_DIR}/pki/private/kube-apiserver.key"

  if [[ -z "${CA_CERT_BUNDLE:-}" ]]; then
    CA_CERT_BUNDLE="${CA_CERT}"
  fi

  CA_CERT_BUNDLE_PATH="${pki_dir}/ca-certificates.crt"
  write-pki-data "${CA_CERT_BUNDLE}" "${CA_CERT_BUNDLE_PATH}"

  if [[ -n "${KUBELET_CERT:-}" && -n "${KUBELET_KEY:-}" ]]; then
    KUBELET_CERT_PATH="${pki_dir}/kubelet.crt"
    write-pki-data "${KUBELET_CERT}" "${KUBELET_CERT_PATH}"

    KUBELET_KEY_PATH="${pki_dir}/kubelet.key"

			BasicConstraintsValid: true,
			IsCA:                  true,

			OCSPServer:            []string{"http://ocsp.example.com"},
			IssuingCertificateURL: []string{"http://crt.example.com/ca1.crt"},

			DNSNames:       []string{"test.example.com"},
			EmailAddresses: []string{"******@****.***"},
			IPAddresses:    []net.IP{net.IPv4(127, 0, 0, 1).To4(), net.ParseIP("2001:4860:0:2001::68")},

		`Etc/GMT-14`,
		`Etc/GMT-2`,
		`Etc/GMT-3`,
		`Etc/GMT-4`,
		`Etc/GMT-5`,
		`Etc/GMT-6`,
		`Etc/GMT-7`,
		`Etc/GMT-8`,
		`Etc/GMT-9`,
		`Etc/GMT0`,
		`Etc/Greenwich`,
		`Etc/UCT`,
		`Etc/Universal`,
		`Etc/UTC`,
		`Etc/Zulu`,
		`Europe/Amsterdam`,
		`Europe/Andorra`,
		`Europe/Astrakhan`,
		`Europe/Athens`,
		`Europe/Belfast`,
		`Europe/Belgrade`,

              name: istio-ca-root-cert
          {{- end }}
          {{- if eq .Values.global.pilotCertProvider "kubernetes" }}
          - name: kube-ca-cert
            configMap:
              name: kube-root-ca.crt
          {{- end }}
          {{- if .Values.global.mountMtlsCerts }}
          # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
          - name: istio-certs
            secret:

	type T string
	crt := ChanOf(RecvDir, TypeOf(T("")))
	cst := ChanOf(SendDir, TypeOf(T("")))

	// check that type already in binary is found
	type T1 int
	checkSameType(t, ChanOf(RecvDir, TypeOf(T1(1))), (<-chan T1)(nil))
	checkSameType(t, ChanOf(SendDir, TypeOf(T1(1))), (chan<- T1)(nil))

	// check String form of ChanDir
	if crt.ChanDir().String() != "<-chan" {

vBF,GAAcG,MAAdH,CACtBA,EAAc,CAAdA,EAAiBI,GADKJ,CAEtBT,EAAY,CAAZA,EAAea,IAEbC,EAAYlB,EAAUmB,KAAVnB,CAAgB,GAAhBA,EAAqB,CAArBA,QAEXe,IAAqBG,OAAAA,CAA8B,EAAnDH,ECzDT,iBAA4F,IAAtB9C,0DAAgB,KAC9EmD,EAAqBnD,EAAgBuB,IAAhBvB,CAAuDvC,IAA+B+D,IAA/B/D,QAC3EsD,UCVT,aAA+C,IACvCtG,GAASF,EAAQG,aAARH,CAAsBI,YAC/BgE,EAASlE,EAAOI,gBAAPJ,IACT2I,EAAI1E,WAAWC,EAAO+B,SAAP/B,EAAoB,CAA/BD,EAAoCA,WAAWC,EAAO0E,YAAP1E,EAAuB,CAAlCD,EACxC4E,EAAI5E,WAAWC,EAAOgC,UAAPhC,EAAqB,CAAhCD,EAAqCA,WAAWC,EAAO4E,WAAP5E,EAAsB,CAAjCD,EACzC...

}} {{- end }} {{- if eq .Values.global.pilotCertProvider "istiod" }} - name: istiod-ca-cert configMap: name: istio-ca-root-cert {{- end }} {{- if eq .Values.global.pilotCertProvider "kubernetes" }} - name: kube-ca-cert configMap: name: kube-root-ca.crt {{- end }} {{- if .Values.global.mountMtlsCerts }} # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications. - name: istio-certs secret: optional: true {{ if eq .Spec.ServiceAccountName "" }} secretName: istio.default {{...