},
				BootstrapToken: &kubeoptions.BootstrapTokenAuthenticationOptions{},
				OIDC:           s.Authentication.OIDC,
				RequestHeader:  &apiserveroptions.RequestHeaderAuthenticationOptions{},
				ServiceAccounts: &kubeoptions.ServiceAccountAuthenticationOptions{
					Lookup:           true,
					ExtendExpiration: true,
				},
				TokenFile:            &kubeoptions.TokenFileAuthenticationOptions{},

			diffSelect: "Deployment:*:istiod, Service:*:istiod,MutatingWebhookConfiguration:*:istio-sidecar-injector,ServiceAccount:*:istio-reader-service-account",
			fileSelect: []string{
				"templates/deployment.yaml", "templates/mutatingwebhook.yaml",
				"templates/service.yaml", "templates/reader-serviceaccount.yaml",
			},
		},
		// TODO https://github.com/istio/istio/issues/22347 this is broken for overriding things to default value

		cp(wd+cniConfSubDir+f, tempCNIConfDir+"/"+destFilenm, t)
	}
	for _, f := range ls(wd+k8sSvcAcctSubDir, t) {
		t.Logf("Copying %v into temp k8s serviceaccount dir %v", f, tempK8sSvcAcctDir)
		cp(wd+k8sSvcAcctSubDir+f, tempK8sSvcAcctDir+"/"+f, t)
	}
	t.Logf("Finished pre-populating working dirs")
}

	logPrefix := cacheLogPrefix(resourceName)

	csrHostName := &spiffe.Identity{
		TrustDomain:    sc.configOptions.TrustDomain,
		Namespace:      sc.configOptions.WorkloadNamespace,
		ServiceAccount: sc.configOptions.ServiceAccount,
	}

	cacheLog.Debugf("constructed host name for CSR: %s", csrHostName.String())
	options := pkiutil.CertOptions{
		Host:       csrHostName.String(),

	namespace := pod.ObjectMeta.Namespace
	name := pod.ObjectMeta.Name
	svcAccount := pod.Spec.ServiceAccountName
	return &zdsapi.WorkloadInfo{
		Namespace:      namespace,
		Name:           name,
		ServiceAccount: svcAccount,
	}
}

func (z *ztunnelServer) PodAdded(ctx context.Context, pod *v1.Pod, netns Netns) error {
	latestConn := z.conns.LatestConn()
	if latestConn == nil {

	isAuthorized := func() bool {
		if authzResult != nil {
			return *authzResult
		}
		res := false
		if err := secrets.Authorize(proxy.VerifiedIdentity.ServiceAccount, proxy.VerifiedIdentity.Namespace); err == nil {
			res = true
		} else {
			authzError = err
		}
		authzResult = &res
		return res
	}

	// There are 4 cases of secret reference

	discovery1 := memory.NewServiceDiscovery(mock.HelloService)

	discovery2 := memory.NewServiceDiscovery(mock.MakeService(mock.ServiceArgs{
		Hostname:        mock.HelloService.Hostname,
		Address:         "10.1.2.0",
		ServiceAccounts: []string{},
		ClusterID:       "cluster-2",
	}), mock.WorldService)

	registry1 := serviceregistry.Simple{
		ProviderID:          provider.Kubernetes,
		ClusterID:           "cluster-1",

        windowsOptions:
          gmsaCredentialSpec: gmsaCredentialSpecValue
          gmsaCredentialSpecName: gmsaCredentialSpecNameValue
          hostProcess: true
          runAsUserName: runAsUserNameValue
      serviceAccount: serviceAccountValue
      serviceAccountName: serviceAccountNameValue
      setHostnameAsFQDN: true
      shareProcessNamespace: true
      subdomain: subdomainValue
      terminationGracePeriodSeconds: 4

        windowsOptions:
          gmsaCredentialSpec: gmsaCredentialSpecValue
          gmsaCredentialSpecName: gmsaCredentialSpecNameValue
          hostProcess: true
          runAsUserName: runAsUserNameValue
      serviceAccount: serviceAccountValue
      serviceAccountName: serviceAccountNameValue
      setHostnameAsFQDN: true
      shareProcessNamespace: true
      subdomain: subdomainValue
      terminationGracePeriodSeconds: 4

        windowsOptions:
          gmsaCredentialSpec: gmsaCredentialSpecValue
          gmsaCredentialSpecName: gmsaCredentialSpecNameValue
          hostProcess: true
          runAsUserName: runAsUserNameValue
      serviceAccount: serviceAccountValue
      serviceAccountName: serviceAccountNameValue
      setHostnameAsFQDN: true
      shareProcessNamespace: true
      subdomain: subdomainValue
      terminationGracePeriodSeconds: 4