func CreateCASecret(ctx resource.Context) error {
	return CreateCustomCASecret(ctx,
		"ca-cert.pem", "ca-key.pem",
		"cert-chain.pem", "root-cert.pem")
}

// CreateCASecretAlt creates a k8s secret "cacerts" to store the CA key and cert using an alternative set of certs.
func CreateCASecretAlt(ctx resource.Context) error {
	return CreateCustomCASecret(ctx,
		"ca-cert-alt.pem", "ca-key-alt.pem",

			if err := cert.CreateCustomCASecret(t,
				"ca-cert-alt.pem", "ca-key-alt.pem",
				"cert-chain-alt.pem", "root-cert-combined-2.pem"); err != nil {
				t.Errorf("failed to update CA secret: %v", err)
			}

			lastUpdateTime = waitForWorkloadCertUpdate(t, from[0], istioCtl, lastUpdateTime)

			// step 3: Remove the old root cert
			if err := cert.CreateCustomCASecret(t,
				"ca-cert-alt.pem", "ca-key-alt.pem",

			if err != nil {
				t.Errorf("failed to get initial workload secret: %v", err)
			}

			// Update CA with new intermediate cert
			if err := cert.CreateCustomCASecret(t,
				"ca-cert-alt-2.pem", "ca-key-alt-2.pem",
				"cert-chain-alt-2.pem", "root-cert-alt.pem"); err != nil {
				t.Errorf("failed to update CA secret: %v", err)
			}