healthCheck atomic.Pointer[errorHolder]
}

// idTokenVerifier is a wrapper around oidc.IDTokenVerifier. It uses the oidc.IDTokenVerifier
// to verify the raw ID token and then performs audience validation locally.
type idTokenVerifier struct {
	verifier  *oidc.IDTokenVerifier
	audiences sets.Set[string]
}

func (a *jwtAuthenticator) setVerifier(v *idTokenVerifier) {
	a.verifier.Store(v)
	if v != nil {

)

type JwtAuthenticator struct {
	// holder of a mesh configuration for dynamically updating trust domain
	meshHolder mesh.Holder
	audiences  []string
	verifier   *oidc.IDTokenVerifier
}

var _ security.Authenticator = &JwtAuthenticator{}

// newJwtAuthenticator is used when running istiod outside of a cluster, to validate the tokens using OIDC