For instance, given that TLS is enabled and you need to add trust for MinIO's own CA and for the CA of a Keycloak server, a Kubernetes secret can be created from the certificate files using `kubectl`:

```
kubectl -n minio create secret generic minio-trusted-certs --from-file=public.crt --from-file=keycloak.crt
```

If TLS is not enabled, you would need only the third party CA:

```

      - emptyDir: {}
        name: credential-socket
      - emptyDir: {}
        name: workload-certs
{{- if eq .Values.global.pilotCertProvider "istiod" }}
      - name: istiod-ca-cert
        configMap:
          name: istio-ca-root-cert
{{- end }}
      - name: podinfo
        downwardAPI:
          items:
            - path: "labels"
              fieldRef:
                fieldPath: metadata.labels

         * @param op The option of condition to be set up. (NotNull)
         */
        void callback(OP op);
    }

    @FunctionalInterface
    public interface OperatorCall<CA extends EsAbstractConditionAggregation> {

        void callback(CA query);
    }

          path: istio-token
          expirationSeconds: 43200
          audience: {{ .Values.global.sds.token.aud }}
  {{- if eq .Values.global.pilotCertProvider "istiod" }}
  - name: istiod-ca-cert
    configMap:
      name: istio-ca-root-cert
  {{- end }}
  {{- if .Values.global.mountMtlsCerts }}
  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
  - name: istio-certs
    secret:

            "analyzer": "empty_analyzer"
          }
        }
      },
      {
        "lang_ca": {
          "match": "*_ca",
          "mapping": {
            "type": "text",
            "analyzer": "catalan_analyzer"
          }
        }
      },
      {
        "lang_ca": {
          "match": "*_ckb-iq",
          "mapping": {
            "type": "text",

            "analyzer": "empty_analyzer"
          }
        }
      },
      {
        "lang_ca": {
          "match": "*_ca",
          "mapping": {
            "type": "text",
            "analyzer": "catalan_analyzer"
          }
        }
      },
      {
        "lang_ca": {
          "match": "*_ckb-iq",
          "mapping": {
            "type": "text",

            "analyzer": "empty_analyzer"
          }
        }
      },
      {
        "lang_ca": {
          "match": "*_ca",
          "mapping": {
            "type": "text",
            "analyzer": "catalan_analyzer"
          }
        }
      },
      {
        "lang_ca": {
          "match": "*_ckb-iq",
          "mapping": {
            "type": "text",

	// a single client certificate. Otherwise, the certificate to
	// policy mapping would be ambiguous.
	// However, we can filter all CA certificates and only check
	// whether they client has sent exactly one (non-CA) leaf certificate.
	peerCertificates := make([]*x509.Certificate, 0, len(r.TLS.PeerCertificates))
	for _, cert := range r.TLS.PeerCertificates {
		if cert.IsCA {
			continue
		}

	"istio.io/istio/istioctl/pkg/cli"
	"istio.io/istio/pilot/test/util"
	"istio.io/istio/pkg/config/constants"
	"istio.io/istio/pkg/kube"
	"istio.io/istio/pkg/test/util/assert"
)

var fakeCACert = []byte("fake-CA-cert")

var (
	defaultYAML = `apiVersion: networking.istio.io/v1alpha3
kind: WorkloadGroup
metadata:
  name: foo
  namespace: bar
spec:
  metadata: {}
  template:
    serviceAccount: default
`

          ),
        signatureValue =
          BitString(
            byteString = signatureBytes,
            unusedBitsCount = 0,
          ),
      ),
    )
  }

  @Test
  fun `decode CA certificate`() {
    val certificateBase64 =
      """
      |MIIE/zCCA+egAwIBAgIEUdNARDANBgkqhkiG9w0BAQsFADCBsDELMAkGA1UEBhMC
      |VVMxFjAUBgNVBAoTDUVudHJ1c3QsIEluYy4xOTA3BgNVBAsTMHd3dy5lbnRydXN0