* Ensure traffic between mesh workloads is securely encrypted with an Istio identity.
* Be lightweight enough to not limit adoption.
  * This puts a much tighter budget on CPU, memory, latency, and throughput requirements than traditional Istio sidecars.

Ztunnel was not designed to be a feature-rich data plane.

  // volumeNamespace specifies the scope of the volume within StorageOS.  If no
  // namespace is specified then the Pod's namespace will be used.  This allows the
  // Kubernetes name scoping to be mirrored within StorageOS for tighter integration.
  // Set VolumeName to any name to override the default behaviour.
  // Set to "default" if you are not using namespaces within StorageOS.
  // Namespaces that do not pre-exist within StorageOS will be created.

It should be noted there is a circular dependency with mTLS authentication; in order to fetch a certificate we need
a certificate. This can be handled in various ways:
* `GenerateSecret` may additionally write any signed certificates to disk, with `OUTPUT_CERTS` configured.
* Users may have external CA setups that pre-configure certificates.
* The CaClient can use JWT token for the initial setup, then switch to mTLS certificates.