expected: &model.NodeMetaProxyConfig{DiscoveryAddress: "fake"},
		},
		{
			testName: "pilotSAN",
			key:      "pilot_SAN",
			option:   option.PilotSubjectAltName([]string{"fake"}),
			expected: `[{"exact":"fake"}]`,
		},
		{
			testName: "pilotSAN multi",
			key:      "pilot_SAN",
			option:   option.PilotSubjectAltName([]string{"fake", "other"}),

	return a.EnvoyDisabled() && !a.envoyOpts.TestOnly
}

func (a *Agent) generateNodeMetadata() (*model.Node, error) {
	var pilotSAN []string
	if a.proxyConfig.ControlPlaneAuthPolicy == mesh.AuthenticationPolicy_MUTUAL_TLS {
		// Obtain Pilot SAN, using DNS.
		pilotSAN = []string{config.GetPilotSan(a.proxyConfig.DiscoveryAddress)}
	}

	// Owner specifies the workload owner (opaque string). Typically, this is the owning controller of
	// of the workload instance (ex: k8s deployment for a k8s pod).
	Owner string `json:"OWNER,omitempty"`

	// PilotSAN is the list of subject alternate names for the xDS server.
	PilotSubjectAltName []string `json:"PILOT_SAN,omitempty"`

	// XDSRootCert defines the root cert to use for XDS connections
	XDSRootCert string `json:"-"`