This means Ztunnel will have multiple distinct certificates at a time, one for each unique identity (service account) running on its node.

When fetching certificates, ztunnel will authenticate to the CA with its own identity, but request the identity of another workload.
Critically, the CA must enforce that the ztunnel has permission to request that identity.

			args: strings.Split("service productpage", " "),
			expectedOutput: `Service: productpage
DestinationRule: productpage for "productpage"
   WARNING POD DOES NOT MATCH ANY SUBSETS.  (Non matching subsets v1)
   Matching subsets: 
      (Non-matching subsets v1)
   No Traffic Policy
VirtualService: bookinfo
   Route to host "productpage" with weight 30%
   Route to host "productpage2" with weight 20%

  // +optional
  optional string path = 1;

  // pathType determines the interpretation of the path matching. PathType can
  // be one of the following values:
  // * Exact: Matches the URL path exactly.
  // * Prefix: Matches based on a URL path prefix split by '/'. Matching is
  //   done on a path element by element basis. A path element refers is the

                if (!containsModule(moduleName, cache)) {
                    /*
                     * Not patching an existing module. This case should be unusual. If it nevertheless
                     * happens, add on class-path or module-path if allowed, or keep patching otherwise.
                     * The latter case (keep patching) is okay if the main module will be defined later.
                     */

  // `resourceRules` is a slice of ResourcePolicyRules that identify matching requests according to their verb and the
  // target resource.
  // At least one of `resourceRules` and `nonResourceRules` has to be non-empty.
  // +listType=atomic
  // +optional
  repeated ResourcePolicyRule resourceRules = 2;

  // `nonResourceRules` is a list of NonResourcePolicyRules that identify matching requests according to their verb

  // `resourceRules` is a slice of ResourcePolicyRules that identify matching requests according to their verb and the
  // target resource.
  // At least one of `resourceRules` and `nonResourceRules` has to be non-empty.
  // +listType=atomic
  // +optional
  repeated ResourcePolicyRule resourceRules = 2;

  // `nonResourceRules` is a list of NonResourcePolicyRules that identify matching requests according to their verb

                "matcher_tree": {
                  "input": {
                    "name": "ip",
                    "typed_config": {
                      "@type": "type.googleapis.com/envoy.extensions.matching.common_inputs.network.v3.DestinationIPInput"
                    }
                  },
                  "custom_match": {
                    "name": "ip",
                    "typed_config": {

  // +optional
  optional string path = 1;

  // pathType determines the interpretation of the path matching. PathType can
  // be one of the following values:
  // * Exact: Matches the URL path exactly.
  // * Prefix: Matches based on a URL path prefix split by '/'. Matching is
  //   done on a path element by element basis. A path element refers is the

    ListenableFuture<Integer> derived =
        catching(primary, Throwable.class, fallback, directExecutor());
    derived.cancel(false);
    assertTrue(primary.isCancelled());
    assertFalse(primary.wasInterrupted());
  }

  // catching() uses a plain Function, so there's no testCatching_resultCancelledAfterFallback().

  // catching() uses a plain Function, so there's no testCatching_nullInsteadOfFuture().

			var err error
			idx, err = strconv.Atoi(pool)
			if err != nil {
				// We didn't find any matching pools, invalid input
				writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, errInvalidArgument), r.URL)
				return
			}
		} else {
			idx = globalEndpoints.GetPoolIdx(pool)
			if idx == -1 {
				// We didn't find any matching pools, invalid input
				writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, errInvalidArgument), r.URL)