}

// GetCABundle returns the CABundle.
func (w *Watcher) GetCABundle() []byte {
	w.mutex.RLock()
	defer w.mutex.RUnlock()
	return w.bundle.CABundle
}

// GetKeyCertBundle returns the bundle.
func (w *Watcher) GetKeyCertBundle() KeyCertBundle {
	w.mutex.RLock()
	defer w.mutex.RUnlock()
	return w.bundle

	s.environment.AddMeshHandler(func() {
		newCaBundle, _ := s.RA.GetRootCertFromMeshConfig(signerName)
		if newCaBundle != nil && !bytes.Equal(newCaBundle, s.istiodCertBundleWatcher.GetKeyCertBundle().CABundle) {
			newCertChain, newKeyPEM, _, err := chiron.GenKeyCertK8sCA(s.kubeClient.Kube(),
				strings.Join(s.dnsNames, ","), "", signerName, true, SelfSignedCACertTTL.Get())
			if err != nil {

			var certRotated bool
			var rotatedCertBytes []byte
			err := retry.Until(func() bool {
				rotatedCertBytes = s.istiodCertBundleWatcher.GetKeyCertBundle().CertPem
				st := string(rotatedCertBytes)
				certRotated = st != string(tt.certToWatch)
				return certRotated == tt.certRotated
			}, retry.Timeout(10*time.Second))

			close(stop)
			if err != nil {