}
	userAdmClient.SetCustomTransport(s.TestSuiteCommon.client.Transport)

	// Create svc acc
	cr := c.mustCreateSvcAccount(ctx, value.AccessKeyID, userAdmClient)

	// 1. Check that svc account appears in listing
	c.assertSvcAccAppearsInListing(ctx, userAdmClient, value.AccessKeyID, cr.AccessKey)

	// 2. Check that svc account info can be queried

	svcs, err := cli.Kube().CoreV1().Services(metav1.NamespaceAll).List(context.Background(), metav1.ListOptions{})
	if err != nil {
		return err
	}
	for _, svc := range svcs.Items {
		if svc.Spec.Type != corev1.ServiceTypeExternalName {
			continue
		}
		res := ObjectToInstance(&svc)
		messages.Add(msg.NewUpdateIncompatibility(res,
			"ENABLE_EXTERNAL_NAME_ALIAS", "1.20",

	}

	if isRevisioned(revision) {
		overrides["CA_ADDR"] = IstiodAddr(istioNamespace, revision)
	}
	if len(internalIP) > 0 {
		overrides["ISTIO_SVC_IP"] = internalIP
	} else if len(externalIP) > 0 {
		overrides["ISTIO_SVC_IP"] = externalIP
		overrides["REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION"] = "true"
	}

  # Retrieve full certificate dump of workloads for a given Ztunnel instance.
  istioctl x ztunnel-config services <ztunnel-name[.namespace]> -o json
`,
		Aliases: []string{"services", "s", "svc"},
		Args:    common.validateArgs,
		RunE: runConfigDump(ctx, common, func(cw *ztunnelDump.ConfigWriter) error {
			filter := ztunnelDump.ServiceFilter{
				Namespace: serviceNamespace,
			}

		store.loadUser(ctx, accessKey, svcUser, cache.iamUsersMap)
		var svc UserIdentity
		svc, found = cache.iamUsersMap[accessKey]
		if found {
			// Load parent user and mapped policies.
			if store.getUsersSysType() == MinIOUsersSysType {
				store.loadUser(ctx, svc.Credentials.ParentUser, regUser, cache.iamUsersMap)
				store.loadMappedPolicyWithRetry(ctx, svc.Credentials.ParentUser, regUser, false, cache.iamUserPolicyMap, 3)

				return err
			}

			matchingServices := make([]corev1.Service, 0, len(svcs.Items))
			for _, svc := range svcs.Items {
				if len(svc.Spec.Selector) > 0 {
					svcSelector := klabels.SelectorFromSet(svc.Spec.Selector)
					if svcSelector.Matches(podLabels) {
						matchingServices = append(matchingServices, svc)
					}
				}
			}
			// Validate Istio's "Service association" requirement

			return
		}
	}

	var serviceAccountList []madmin.ServiceAccountInfo
	var stsKeyList []madmin.ServiceAccountInfo

	for _, svc := range serviceAccounts {
		expiryTime := svc.Expiration
		serviceAccountList = append(serviceAccountList, madmin.ServiceAccountInfo{
			AccessKey:  svc.AccessKey,
			Expiration: &expiryTime,
		})
	}
	for _, sts := range stsKeys {
		expiryTime := sts.Expiration

	// 1.2 Check that svc account appears in listing
	c.assertSvcAccAppearsInListing(ctx, s.adm, accessKey, cr.AccessKey)

	// 1.3 Check that svc account info can be queried
	c.assertSvcAccInfoQueryable(ctx, s.adm, accessKey, cr.AccessKey, false)

	// 2. Check that svc account can access the bucket
	c.assertSvcAccS3Access(ctx, s, cr, bucket)

	// 3. Check that svc account can restrict the policy, and that the

	unique := sets.New(domains...)
	shouldDelete := sets.New[string]()
	for _, h := range domains {
		stripFull := strings.TrimSuffix(h, ".svc.cluster.local")
		if unique.Contains(stripFull) && stripFull != h {
			shouldDelete.Insert(h)
		}
		stripPartial := strings.TrimSuffix(h, ".svc")
		if unique.Contains(stripPartial) && stripPartial != h {
			shouldDelete.Insert(h)
		}
	}

	for _, svc := range serviceAccounts {
		expiryTime := svc.Expiration
		serviceAccountList = append(serviceAccountList, madmin.ServiceAccountInfo{
			Description:   svc.Description,
			ParentUser:    svc.ParentUser,
			Name:          svc.Name,
			AccountStatus: svc.Status,
			AccessKey:     svc.AccessKey,
			ImpliedPolicy: svc.IsImpliedPolicy(),
			Expiration:    &expiryTime,