}()
		return nil
	})
	s.istiodCertBundleWatcher.SetAndNotify(keyPEM, certChain, caBundle)
	return nil
}

// initDNSCertsIstiod will issue DNS certs using Istiod CA, and set the root certs for
// distribution. Only called from initIstiodCerts if PILOT_CERT_PROVIDER=istiod (default)
func (s *Server) initDNSCertsIstiod() error {
	var certChain, keyPEM, caBundle []byte
	var err error

	} else if features.EnableCAServer && features.PilotCertProvider == constants.CertProviderIstiod {
		log.Infof("initializing Istiod DNS certificates host: %s, custom host: %s", host, features.IstiodServiceCustomHost)
		err = s.initDNSCertsIstiod()
	} else if features.PilotCertProvider == constants.CertProviderKubernetes {
		// This will not work - better to fail Istiod startup so it can be detected early.