CredFetcher CredFetcher

	// credential identity provider
	CredIdentityProvider string

	// Namespace corresponding to workload
	WorkloadNamespace string

	// Name of the Service Account
	ServiceAccount string

	// XDS auth provider
	XdsAuthProvider string

	// Cert signer info
	CertSigner string

	// Delay in reading certificates from file after the change is detected. This is useful in cases

    # Default behavior: latest images will be Always else IfNotPresent.
    imagePullPolicy: ""

    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
    # to use for pulling any images in pods that reference this ServiceAccount.
    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.

	rootCertPollingInterval = 60 * time.Second

	// Default CA certificate path
	// Currently, custom CA path is not supported; no API to get custom CA cert yet.
	defaultCACertPath = "./var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
)

// initDNSCertsK8SRA will create the certificates using K8S RA.
// Only called by initIstiodCerts if provider (PILOT_CERT_PROVIDER) has k8s.io prefix
// and local certificates are not found.
//

  // The SPIFFE identity of the workload. The identity is joined to form spiffe://<trust_domain>/ns/<namespace>/sa/<service_account>.
  // TrustDomain of the workload. May be elided if this is the mesh wide default (typically cluster.local)
  string trust_domain = 6;
  // ServiceAccount of the workload. May be elided if this is "default"
  string service_account = 7;

  // If present, the waypoint proxy for this workload.

			diffSelect: "Deployment:*:istiod, Service:*:istiod,MutatingWebhookConfiguration:*:istio-sidecar-injector,ServiceAccount:*:istio-reader-service-account",
			fileSelect: []string{
				"templates/deployment.yaml", "templates/mutatingwebhook.yaml",
				"templates/service.yaml", "templates/reader-serviceaccount.yaml",
			},
		},
		// TODO https://github.com/istio/istio/issues/22347 this is broken for overriding things to default value

		cp(wd+cniConfSubDir+f, tempCNIConfDir+"/"+destFilenm, t)
	}
	for _, f := range ls(wd+k8sSvcAcctSubDir, t) {
		t.Logf("Copying %v into temp k8s serviceaccount dir %v", f, tempK8sSvcAcctDir)
		cp(wd+k8sSvcAcctSubDir+f, tempK8sSvcAcctDir+"/"+f, t)
	}
	t.Logf("Finished pre-populating working dirs")
}

	namespace := pod.ObjectMeta.Namespace
	name := pod.ObjectMeta.Name
	svcAccount := pod.Spec.ServiceAccountName
	return &zdsapi.WorkloadInfo{
		Namespace:      namespace,
		Name:           name,
		ServiceAccount: svcAccount,
	}
}

func (z *ztunnelServer) PodAdded(ctx context.Context, pod *v1.Pod, netns Netns) error {
	latestConn := z.conns.LatestConn()
	if latestConn == nil {

        windowsOptions:
          gmsaCredentialSpec: gmsaCredentialSpecValue
          gmsaCredentialSpecName: gmsaCredentialSpecNameValue
          hostProcess: true
          runAsUserName: runAsUserNameValue
      serviceAccount: serviceAccountValue
      serviceAccountName: serviceAccountNameValue
      setHostnameAsFQDN: true
      shareProcessNamespace: true
      subdomain: subdomainValue
      terminationGracePeriodSeconds: 4

        windowsOptions:
          gmsaCredentialSpec: gmsaCredentialSpecValue
          gmsaCredentialSpecName: gmsaCredentialSpecNameValue
          hostProcess: true
          runAsUserName: runAsUserNameValue
      serviceAccount: serviceAccountValue
      serviceAccountName: serviceAccountNameValue
      setHostnameAsFQDN: true
      shareProcessNamespace: true
      subdomain: subdomainValue
      terminationGracePeriodSeconds: 4

        windowsOptions:
          gmsaCredentialSpec: gmsaCredentialSpecValue
          gmsaCredentialSpecName: gmsaCredentialSpecNameValue
          hostProcess: true
          runAsUserName: runAsUserNameValue
      serviceAccount: serviceAccountValue
      serviceAccountName: serviceAccountNameValue
      setHostnameAsFQDN: true
      shareProcessNamespace: true
      subdomain: subdomainValue
      terminationGracePeriodSeconds: 4