John Howard <******@****.***> 1709691190 -0800

		}
	}

	var secrets map[string][]byte
	if len(wasmSecrets) > 0 {
		// Generate the pull secrets first, which will be used when populating the extension config.
		if e.secretController != nil {
			var err error
			secretController, err := e.secretController.ForCluster(proxy.Metadata.ClusterID)
			if err != nil {
				log.Warnf("proxy %s is from an unknown cluster, cannot retrieve certificates for Wasm image pull: %v", proxy.ID, err)

)

var k8sControllerLog = log.RegisterScope("secretcontroller", "Citadel kubernetes controller log")

// CaSecretController manages the self-signed signing CA secret.
type CaSecretController struct {
	client corev1.CoreV1Interface
}

// NewCaSecretController returns a pointer to a newly constructed SecretController instance.
func NewCaSecretController(core corev1.CoreV1Interface) *CaSecretController {
	cs := &CaSecretController{
		client: core,

	var secretController credscontroller.Controller
	switch sr.ResourceType {
	case credentials.KubernetesGatewaySecretType:
		secretController = configClusterSecrets
	default:
		secretController = proxyClusterSecrets
	}

	isCAOnlySecret := strings.HasSuffix(sr.Name, securitymodel.SdsCaSuffix)
	if isCAOnlySecret {
		caCertInfo, err := secretController.GetCaCert(sr.Name, sr.Namespace)

}

// SelfSignedCARootCertRotator automatically checks self-signed signing root
// certificate and rotates root certificate if it is going to expire.
type SelfSignedCARootCertRotator struct {
	caSecretController *controller.CaSecretController
	config             *SelfSignedCARootCertRotatorConfig
	backOffTime        time.Duration
	ca                 *IstioCA
	onRootCertUpdate   func() error
}

	ecdsGen := &xds.EcdsGenerator{ConfigGenerator: cg}
	if env.CredentialsController != nil {
		generators[v3.SecretType] = xds.NewSecretGen(env.CredentialsController, s.Cache, clusterID, env.Mesh())
		ecdsGen.SetCredController(env.CredentialsController)
	}
	generators[v3.ExtensionConfigurationType] = ecdsGen
	generators[v3.NameTableType] = &xds.NdsGenerator{ConfigGenerator: cg}

	s.Generators[v3.SecretType] = xds.NewSecretGen(creds, s.Cache, opts.DefaultClusterName, nil)
	s.Generators[v3.ExtensionConfigurationType].(*xds.EcdsGenerator).SetCredController(creds)

	memRegistry := cg.MemRegistry
	memRegistry.XdsUpdater = s

	// Setup config handlers
	// TODO code re-use from server.go
	configHandler := func(_, curr config.Config, event model.Event) {