// certificate that is preceded by the CAs that sign them.
	var lastCACert *certsphase.KubeadmCert
	for _, cert := range certsphase.GetDefaultCertList() {
		var phase workflow.Phase
		if cert.CAName == "" {
			phase = newCertSubPhase(cert, runCAPhase(cert))
			lastCACert = cert
		} else {
			phase = newCertSubPhase(cert, runCertPhase(cert, lastCACert))
		}
		subPhases = append(subPhases, phase)
	}

	t.Helper()
	actual, err := s.getIstiodCertificate(nil)
	if err != nil {
		t.Fatalf("fail to load fetch certs.")
	}
	expected, err := tls.X509KeyPair(cert, key)
	if err != nil {
		t.Fatalf("fail to load test certs.")
	}
	return bytes.Equal(actual.Certificate[0], expected.Certificate[0])
}

func TestGetDNSNames(t *testing.T) {
	tests := []struct {
		name             string

  echo "Generating certs for alternate-names: ${sans}"

  setup-easyrsa
  PRIMARY_CN="${primary_cn}" SANS="${sans}" generate-certs
  AGGREGATOR_PRIMARY_CN="${primary_cn}" AGGREGATOR_SANS="${sans}" generate-aggregator-certs
  KONNECTIVITY_SERVER_PRIMARY_CN="${primary_cn}" KONNECTIVITY_SERVER_SANS="${sans}" generate-konnectivity-server-certs

	lock                sync.RWMutex
	namespaces          kclient.Client[*corev1.Namespace]
	discoveryNamespaces sets.String
	discoverySelectors  []labels.Selector // nil if discovery selectors are not specified, permits all namespaces for discovery
	handlers            []func(added, removed sets.String)
}

func NewDiscoveryNamespacesFilter(
	namespaces kclient.Client[*corev1.Namespace],
	mesh mesh.Watcher,
	stop <-chan struct{},

	obj.Node.EtcdUpgrade = ptr.To(true)
	obj.Node.CertificateRenewal = ptr.To(false)
	obj.Node.ImagePullPolicy = corev1.PullIfNotPresent
	obj.Node.ImagePullSerial = ptr.To(true)

	obj.Apply.EtcdUpgrade = ptr.To(true)
	obj.Apply.CertificateRenewal = ptr.To(false)
	obj.Apply.ImagePullPolicy = corev1.PullIfNotPresent
	obj.Apply.ImagePullSerial = ptr.To(true)

	kubeadm.SetDefaultTimeouts(&obj.Timeouts)

	}}})
	testns := clienttest.NewWriter[*corev1.Namespace](t, c)
	discoveryNamespacesFilter := filter.NewDiscoveryNamespacesFilter(
		kclient.New[*corev1.Namespace](c),
		meshWatcher,
		test.NewStop(t),
	)
	namespaces := kclient.NewFiltered[*corev1.Namespace](c, kubetypes.Filter{
		ObjectFilter: discoveryNamespacesFilter,
	})
	c.RunAndWait(test.NewStop(t))

EOF

# Create certificates for TLS enabled MinIO
echo -n "Setup certs for MinIO instances ..."
wget -O certgen https://github.com/minio/certgen/releases/latest/download/certgen-linux-amd64 && chmod +x certgen
./certgen --host localhost
mkdir -p /tmp/certs
mv public.crt /tmp/certs || sudo mv public.crt /tmp/certs
mv private.key /tmp/certs || sudo mv private.key /tmp/certs
echo "done"

# Start MinIO instances

# Create certificates for TLS enabled MinIO
echo -n "Setup certs for MinIO instances ..."
wget -O certgen https://github.com/minio/certgen/releases/latest/download/certgen-linux-amd64 && chmod +x certgen
./certgen --host localhost
mkdir -p /tmp/certs
mv public.crt /tmp/certs || sudo mv public.crt /tmp/certs
mv private.key /tmp/certs || sudo mv private.key /tmp/certs
echo "done"

# Start MinIO instances

		// still seting the root from /etc/certs/root-cert.pem for distribution in the
		// namespace controller.
		// The new behavior appears safer - IMO we may also do a fatal unless provider is
		// set to "none" because it is not clear what the user intends.

		// Skip invoking initIstiodCertLoader - we have no cert.
		return nil
	}

	if err == nil {

	return nil
}

func isAmbientPod(client kubernetes.Interface, podName, podNamespace string) (bool, error) {
	pod, err := client.CoreV1().Pods(podNamespace).Get(context.Background(), podName, metav1.GetOptions{})
	if err != nil {
		return false, err
	}
	ns, err := client.CoreV1().Namespaces().Get(context.Background(), podNamespace, metav1.GetOptions{})
	if err != nil {
		return false, err
	}