- name: istio-data
        emptyDir: {}
      - name: istio-token
        projected:
          sources:
          - serviceAccountToken:
              path: istio-token
              expirationSeconds: 43200
              audience: {{ .Values.global.sds.token.aud }}
      {{- if .Values.global.mountMtlsCerts }}
      # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.

      name: kube-dns
      optional: true
    name: kube-dns-config
  - name: kube-api-access-s8rz5
    projected:
      defaultMode: 420
      sources:
      - serviceAccountToken:
          expirationSeconds: 3607
          path: token
      - configMap:
          items:
          - key: ca.crt
            path: ca.crt
          name: kube-root-ca.crt
      - downwardAPI:
          items:

	// It will default to the audiences of kube apiserver.
	//
	Audience string

	// ExpirationSeconds is the duration of validity of the token in "TokenRequestSpec".
	// It has the same default value of "ExpirationSeconds" in "TokenRequestSpec."
	//
	// +optional
	ExpirationSeconds *int64
}

const (
	// VolumeLifecyclePersistent explicitly confirms that the driver implements

      name: kube-dns
      optional: true
    name: kube-dns-config
  - name: kube-api-access-s8rz5
    projected:
      defaultMode: 420
      sources:
      - serviceAccountToken:
          expirationSeconds: 3607
          path: token
      - configMap:
          items:
          - key: ca.crt
            path: ca.crt
          name: kube-root-ca.crt
      - downwardAPI:
          items:

          fieldRef:
            fieldPath: metadata.annotations
  - name: istio-token
    projected:
      sources:
      - serviceAccountToken:
          path: istio-token
          expirationSeconds: 43200
          audience: {{ .Values.global.sds.token.aud }}
  {{- if eq .Values.global.pilotCertProvider "istiod" }}
  - name: istiod-ca-cert
    configMap:
      name: istio-ca-root-cert
  {{- end }}

}

func (c *client) CreatePerRPCCredentials(_ context.Context, tokenNamespace, tokenServiceAccount string, audiences []string,
	expirationSeconds int64,
) (credentials.PerRPCCredentials, error) {
	return NewRPCCredentials(c, tokenNamespace, tokenServiceAccount, audiences, expirationSeconds, 60)
}

func (c *client) UtilFactory() PartialFactory {
	return c.clientFactory
}

                mode: 3
                path: pathValue
              name: nameValue
              optional: true
            serviceAccountToken:
              audience: audienceValue
              expirationSeconds: 2
              path: pathValue
        quobyte:
          group: groupValue
          readOnly: true
          registry: registryValue
          tenant: tenantValue
          user: userValue

              mode: 3
              path: pathValue
            name: nameValue
            optional: true
          serviceAccountToken:
            audience: audienceValue
            expirationSeconds: 2
            path: pathValue
      quobyte:
        group: groupValue
        readOnly: true
        registry: registryValue
        tenant: tenantValue
        user: userValue

                mode: 3
                path: pathValue
              name: nameValue
              optional: true
            serviceAccountToken:
              audience: audienceValue
              expirationSeconds: 2
              path: pathValue
        quobyte:
          group: groupValue
          readOnly: true
          registry: registryValue
          tenant: tenantValue
          user: userValue

                mode: 3
                path: pathValue
              name: nameValue
              optional: true
            serviceAccountToken:
              audience: audienceValue
              expirationSeconds: 2
              path: pathValue
        quobyte:
          group: groupValue
          readOnly: true
          registry: registryValue
          tenant: tenantValue
          user: userValue