However, the identities of the certificates will be of the actual user workloads, not Ztunnel's own identity.
This means Ztunnel will have multiple distinct certificates at a time, one for each unique identity (service account) running on its node.

When fetching certificates, ztunnel will authenticate to the CA with its own identity, but request the identity of another workload.

order to provision the TLS trust. Because Istiod's CA certificate is somewhat dynamic, this is patched at runtime (rather than part of the install). The webhook controllers handle this patching.

These controllers are very similar but are distinct components for a variety of reasons....

  repeated ObjectReference secrets = 2;

  // ImagePullSecrets is a list of references to secrets in the same namespace to use for pulling any images
  // in pods that reference this ServiceAccount. ImagePullSecrets are distinct from Secrets because Secrets
  // can be mounted in the pod, but ImagePullSecrets are only accessed by the kubelet.
  // More info: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod

  // empty string if the object was updated through the main resource. The
  // value of this field is used to distinguish between managers, even if they
  // share the same name. For example, a status update will be distinct from a
  // regular update using the same manager name.
  // Note that the APIVersion field is not related to the Subresource field and
  // it always corresponds to the version of the main resource.