executions.size() == 2
        def projectExecution = executions.find { it.details.identity == projectTransformIdentification.identity }
        def externalExecution = executions.find { it.details.identity == externalTransformIdentification.identity }
        [projectExecution, externalExecution].each {
            with(it) {
                details.workType == 'TRANSFORM'
            }

    // expected-error @+1 {{'tf.Identity' op is expected to have either both or none of '_replication_info' and '_xla_compile_device_type' attributes}}
    %outputs_15, %control_16 = tf_executor.island wraps "tf.Identity"(%outputs_13) {_replication_info = "cluster", _tpu_output_identity = true, device = "/device:TPU_REPLICATED_CORE:0"} : (tensor<*xf32>) -> tensor<*xf32>

    // CHECK: "tf.Identity"
    // CHECK-SAME: _xla_outside_compilation
    // CHECK-SAME: tf_type.string
    // CHECK: "tf.Identity"
    // CHECK-NOT: _xla_outside_compilation
    %1 = "tf.Const"() {value = dense<1> : tensor<i32>} : () -> tensor<i32>
    %2 = "tf.Identity"(%arg0)  : (tensor<!tf_type.string>) -> tensor<!tf_type.string>
    %3 = "tf.Identity"(%1) : (tensor<i32>) -> tensor<i32>

type GCEPlugin struct {
	// aud is the unique URI agreed upon by both the instance and the system verifying the instance's identity.
	// For more info: https://cloud.google.com/compute/docs/instances/verifying-instance-identity
	aud string

	// The location to save the identity token
	jwtPath string

	// identity provider
	identityProvider string

	// token refresh
	rotationTicker *time.Ticker
	closing        chan bool

					logger.V(2).Info("item references an owner with coordinates that do not match the observed identity", "item", n.identity, "owner", ownerNode.identity)
				}
				hasPotentiallyInvalidOwnerReference = true
			} else if !ownerIsNamespaced && ownerNode.identity.Namespace != n.identity.Namespace && !ownerNode.isObserved() {

		VerifiedIdentity: &spiffe.Identity{Namespace: "istio-system"},
		Type:             model.Router,
		ConfigNamespace:  "istio-system",
	}
	otherNamespace := &model.Proxy{
		Metadata:         &model.NodeMetadata{ClusterID: constants.DefaultClusterName},
		VerifiedIdentity: &spiffe.Identity{Namespace: "other-namespace"},
		Type:             model.Router,

)

type Identity struct {
	TrustDomain    string
	Namespace      string
	ServiceAccount string
}

func ParseIdentity(s string) (Identity, error) {
	if !strings.HasPrefix(s, URIPrefix) {
		return Identity{}, fmt.Errorf("identity is not a spiffe format")
	}
	split := strings.Split(s[URIPrefixLen:], "/")
	if len(split) != 5 {
		return Identity{}, fmt.Errorf("identity is not a spiffe format")
	}

    auto identity = ops::Identity(scope.WithOpName("while/Identity"),
                                  switch_node.output_true);
    auto identity_shape =
        ops::Const<int32>(scope.WithOpName("while/Identity/shape"), {});
    auto identity_reshaped = ops::Reshape(
        scope.WithOpName("while/Identity/reshaped"), identity, identity_shape);

    auto one = ops::Const<int32>(

)

const (
	// IdentityLeaseComponentLabelKey is used to apply a component label to identity lease objects, indicating:
	//   1. the lease is an identity lease (different from leader election leases)
	//   2. which component owns this lease
	IdentityLeaseComponentLabelKey = "apiserver.kubernetes.io/identity"
)

// Server is a struct that contains a generic control plane apiserver instance

  %631 = "tf.Identity"(%79) {device = ""} : (tensor<?xi64>) -> tensor<?xi64>
  %632 = "tf.Identity"(%630) {device = ""} : (tensor<i1>) -> tensor<i1>
  %633 = "tf.Identity"(%307) {device = ""} : (tensor<i1>) -> tensor<i1>
  %634 = "tf.Shape"(%36#2) {device = ""} : (tensor<?xi64>) -> tensor<1xi32>