meshCfg, err := getMeshConfig(kubeClient, istioNamespace)
	if err != nil {
		return fmt.Errorf("failed to fetch mesh config: %v", err)
	}

	workloadPAList, err := configClient.SecurityV1beta1().PeerAuthentications(workloadNamespace).List(context.Background(), metav1.ListOptions{})
	if err != nil {
		return fmt.Errorf("failed to fetch workload namespace PeerAuthentication: %v", err)
	}

  // It is highly recommended that resourceVersionMatch be set for list calls where
  // resourceVersion is set
  // See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for
  // details.
  //
  // Defaults to unset
  // +optional
  optional string resourceVersionMatch = 10;

  // Timeout for the list/watch call.