// Required to be unique across all JWT authenticators.
	// Note that egress selection configuration is not used for this network connection.
	// +optional
	DiscoveryURL         string
	CertificateAuthority string
	Audiences            []string
	AudienceMatchPolicy  AudienceMatchPolicyType
}

// AudienceMatchPolicyType is a set of valid values for Issuer.AudienceMatchPolicy
type AudienceMatchPolicyType string

			Client:      nil,
			Keys:        []interface{}{getPublicKey(ecdsaPublicKey)},
			ExpectedErr: false,
			ExpectedOK:  false,
		},
	}

	for k, tc := range testCases {
		auds := authenticator.Audiences{"api"}
		getter := serviceaccountcontroller.NewGetterFromClient(
			tc.Client,
			v1listers.NewSecretLister(newIndexer(func(namespace, name string) (interface{}, error) {

	// This value can also be extracted from the mounted token
	trustedIssuer = env.Register("TOKEN_ISSUER", "",
		"OIDC token issuer. If set, will be used to check the tokens.")

	audience = env.Register("AUDIENCE", "",
		"Expected audience in the tokens. ")

	caRSAKeySize = env.Register("CITADEL_SELF_SIGNED_CA_RSA_KEY_SIZE", 2048,
		"Specify the RSA key size to use for self-signed Istio CA certificates.")

  fi
  if [[ -n "${SERVICE_CLUSTER_IP_RANGE:-}" ]]; then
    params+=" --service-cluster-ip-range=${SERVICE_CLUSTER_IP_RANGE}"
  fi
  params+=" --service-account-issuer=${SERVICEACCOUNT_ISSUER}"
  params+=" --api-audiences=${SERVICEACCOUNT_ISSUER}"
  params+=" --service-account-signing-key-file=${SERVICEACCOUNT_KEY_PATH}"

  local audit_policy_config_mount=""
  local audit_policy_config_volume=""
  local audit_webhook_config_mount=""

							allow:  false,
						},
						{
							prefix: "[JWTWithAud]",
							jwt:    jwt.TokenIssuer1WithAud,
							path:   "/audiences",
							allow:  true,
						},
						{
							prefix: "[JWTWithAudList]",
							jwt:    jwt.TokenIssuer1WithAudList,
							path:   "/audiences",
							allow:  true,
						},
					}
					for _, c := range cases {
						h := headers.New().WithAuthz(c.jwt).Build()

	return map_StorageClassList
}

var map_TokenRequest = map[string]string{
	"":                  "TokenRequest contains parameters of a service account token.",
	"audience":          "audience is the intended audience of the token in \"TokenRequestSpec\". It will default to the audiences of kube apiserver.",

  repeated StorageClass items = 2;
}

// TokenRequest contains parameters of a service account token.
message TokenRequest {
  // audience is the intended audience of the token in "TokenRequestSpec".
  // It will default to the audiences of kube apiserver.
  optional string audience = 1;

  // expirationSeconds is the duration of validity of the token in "TokenRequestSpec".

  repeated StorageClass items = 2;
}

// TokenRequest contains parameters of a service account token.
message TokenRequest {
  // audience is the intended audience of the token in "TokenRequestSpec".
  // It will default to the audiences of kube apiserver.
  optional string audience = 1;

  // expirationSeconds is the duration of validity of the token in "TokenRequestSpec".

	return map_StorageClassList
}

var map_TokenRequest = map[string]string{
	"":                  "TokenRequest contains parameters of a service account token.",
	"audience":          "audience is the intended audience of the token in \"TokenRequestSpec\". It will default to the audiences of kube apiserver.",

  repeated StorageClass items = 2;
}

// TokenRequest contains parameters of a service account token.
message TokenRequest {
  // audience is the intended audience of the token in "TokenRequestSpec".
  // It will default to the audiences of kube apiserver.
  optional string audience = 1;

  // expirationSeconds is the duration of validity of the token in "TokenRequestSpec".