// +optional
  optional UserSubject user = 2;

  // `group` matches based on user group name.
  // +optional
  optional GroupSubject group = 3;

  // `serviceAccount` matches ServiceAccounts.
  // +optional
  optional ServiceAccountSubject serviceAccount = 4;
}

// UserSubject holds detailed information for user-kind subject.
message UserSubject {
  // `name` is the username that matches, or "*" to match all usernames.

	ns string, serviceAccount string, kubeClient kube.CLIClient, options Options,
) (map[string]*discovery.DiscoveryResponse, error) {
	return MultiRequestAndProcessXds(true, dr, centralOpts, istioNamespace, ns, serviceAccount, kubeClient, options)
}

	// `group` matches based on user group name.
	// +optional
	Group *GroupSubject `json:"group,omitempty" protobuf:"bytes,3,opt,name=group"`
	// `serviceAccount` matches ServiceAccounts.
	// +optional
	ServiceAccount *ServiceAccountSubject `json:"serviceAccount,omitempty" protobuf:"bytes,4,opt,name=serviceAccount"`
}

// SubjectKind is the kind of subject.
type SubjectKind string

// Supported subject's kinds.
const (

	}

	tokenGenerator, err := serviceaccount.JWTTokenGenerator(serviceaccount.LegacyIssuer, privateKey)
	if err != nil {
		return nil, false, fmt.Errorf("failed to build token generator: %v", err)
	}
	tokenController, err := serviceaccountcontroller.NewTokensController(
		controllerContext.InformerFactory.Core().V1().ServiceAccounts(),
		controllerContext.InformerFactory.Core().V1().Secrets(),

  // +optional
  optional UserSubject user = 2;

  // `group` matches based on user group name.
  // +optional
  optional GroupSubject group = 3;

  // `serviceAccount` matches ServiceAccounts.
  // +optional
  optional ServiceAccountSubject serviceAccount = 4;
}

// UserSubject holds detailed information for user-kind subject.
message UserSubject {
  // `name` is the username that matches, or "*" to match all usernames.

  // +optional
  optional UserSubject user = 2;

  // `group` matches based on user group name.
  // +optional
  optional GroupSubject group = 3;

  // `serviceAccount` matches ServiceAccounts.
  // +optional
  optional ServiceAccountSubject serviceAccount = 4;
}

// UserSubject holds detailed information for user-kind subject.
message UserSubject {
  // `name` is the username that matches, or "*" to match all usernames.

  // +optional
  optional UserSubject user = 2;

  // `group` matches based on user group name.
  // +optional
  optional GroupSubject group = 3;

  // `serviceAccount` matches ServiceAccounts.
  // +optional
  optional ServiceAccountSubject serviceAccount = 4;
}

// UserSubject holds detailed information for user-kind subject.
message UserSubject {
  // `name` is the username that matches, or "*" to match all usernames.

	// waypoint. Must be one of "all", "service", "workload".
	TrafficType string

	// ServiceAccounts from instances of the waypoint.
	// This only handles Pods. If we wish to support non-pod waypoints, we'll
	// want to index ServiceEntry/WorkloadEntry or possibly allow specifying
	// the ServiceAccounts directly on a Gateway resource.
	ServiceAccounts []string
}

	Service                        = config.GroupVersionKind{Group: "", Version: "v1", Kind: "Service"}
	ServiceAccount                 = config.GroupVersionKind{Group: "", Version: "v1", Kind: "ServiceAccount"}
	ServiceEntry                   = config.GroupVersionKind{Group: "networking.istio.io", Version: "v1alpha3", Kind: "ServiceEntry"}

			Ports:          ports.All(),
			ServiceAccount: true,
			Subsets: []echo.SubsetConfig{
				{
					Replicas: 1,
					Version:  "v1",
				},
				{
					Replicas: 1,
					Version:  "v2",
				},
			},
		}).
		WithConfig(echo.Config{
			Service:        Uncaptured,
			Namespace:      apps.Namespace,
			Ports:          ports.All(),
			ServiceAccount: true,
			Subsets: []echo.SubsetConfig{