// Otherwise assume the injection has mounted /etc/certs/root-cert.pem
	return citadel.NewCitadelClient(opts, tlsOpts)
}

func init() {
	providers["Citadel"] = createCitadel
}

func createCAClient(opts *security.Options, a RootCertProvider) (security.Client, error) {
	provider, ok := providers[opts.CAProviderName]
	if !ok {
		return nil, fmt.Errorf("CA provider %q not registered", opts.CAProviderName)
	}

		return cache.NewSecretManagerClient(nil, a.secOpts)
	}
	log.Infof("CA Endpoint %s, provider %s", a.secOpts.CAEndpoint, a.secOpts.CAProviderName)

	caClient, err := createCAClient(a.secOpts, a)
	if err != nil {
		return nil, err
	}
	return cache.NewSecretManagerClient(caClient, a.secOpts)
}