"istio.io/istio/istioctl/pkg/clioptions"
	"istio.io/istio/pilot/pkg/model"
	"istio.io/istio/pkg/adsc"
	"istio.io/istio/pkg/kube"
)

const (
	// defaultExpirationSeconds is how long-lived a token to request (an hour)
	defaultExpirationSeconds = 60 * 60
)

// Audience to create tokens for
var tokenAudiences = []string{"istio-ca"}

        listener.onFailure(
          this,
          IllegalStateException("Invalid content-type: ${body.contentType()}"),
          response,
        )
        return
      }

      // This is a long-lived response. Cancel full-call timeouts.
      call?.timeout()?.cancel()

      // Replace the body with a stripped one so the callbacks can't see real data.
      val response = response.stripBody()

metadata server), and a `TokenExchanger` which allows exchanging a token for another form to match the CA server requirements.

For VMs, the standard flow is for the user to provision a short-lived JWT token onto the VM. After the initial
CSR, certificates are written to disk and mTLS is used for future requests. If the VM restarted, it would continue