This means Ztunnel will have multiple distinct certificates at a time, one for each unique identity (service account) running on its node.

When fetching certificates, ztunnel will authenticate to the CA with its own identity, but request the identity of another workload.
Critically, the CA must enforce that the ztunnel has permission to request that identity.

// Identities are defined as:
//   - Network: A single stable DNS and hostname.
//   - Storage: As many VolumeClaims as requested.
//
// The StatefulSet guarantees that a given network identity will always
// map to the same storage identity.
message StatefulSet {
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Spec defines the desired identities of pods in this set.
  // +optional

  // items is a list of schema objects.
  repeated Lease items = 2;
}

// LeaseSpec is a specification of a Lease.
message LeaseSpec {
  // holderIdentity contains the identity of the holder of a current lease.
  // +optional
  optional string holderIdentity = 1;

  // leaseDurationSeconds is a duration that candidates for a lease need

  // items is a list of schema objects.
  repeated Lease items = 2;
}

// LeaseSpec is a specification of a Lease.
message LeaseSpec {
  // holderIdentity contains the identity of the holder of a current lease.
  // +optional
  optional string holderIdentity = 1;

  // leaseDurationSeconds is a duration that candidates for a lease need

// Identities are defined as:
//   - Network: A single stable DNS and hostname.
//   - Storage: As many VolumeClaims as requested.
//
// The StatefulSet guarantees that a given network identity will always
// map to the same storage identity.
message StatefulSet {
  // Standard object's metadata.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
  // +optional

      "Licensor" shall mean the copyright owner or entity authorized by
      the copyright owner that is granting the License.

      "Legal Entity" shall mean the union of the acting entity and all
      other entities that control, are controlled by, or are under common
      control with that entity. For the purposes of this definition,
      "control" means (i) the power, direct or indirect, to cause the

// Identities are defined as:
//   - Network: A single stable DNS and hostname.
//   - Storage: As many VolumeClaims as requested.
//
// The StatefulSet guarantees that a given network identity will always
// map to the same storage identity.
message StatefulSet {
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Spec defines the desired identities of pods in this set.
  // +optional

      "Licensor" shall mean the copyright owner or entity authorized by
      the copyright owner that is granting the License.

      "Legal Entity" shall mean the union of the acting entity and all
      other entities that control, are controlled by, or are under common
      control with that entity. For the purposes of this definition,
      "control" means (i) the power, direct or indirect, to cause the

  // `resourceRules` is a slice of ResourcePolicyRules that identify matching requests according to their verb and the
  // target resource.
  // At least one of `resourceRules` and `nonResourceRules` has to be non-empty.
  // +listType=atomic
  // +optional
  repeated ResourcePolicyRule resourceRules = 2;

  // `nonResourceRules` is a list of NonResourcePolicyRules that identify matching requests according to their verb

  // `resourceRules` is a slice of ResourcePolicyRules that identify matching requests according to their verb and the
  // target resource.
  // At least one of `resourceRules` and `nonResourceRules` has to be non-empty.
  // +listType=atomic
  // +optional
  repeated ResourcePolicyRule resourceRules = 2;

  // `nonResourceRules` is a list of NonResourcePolicyRules that identify matching requests according to their verb