// TODO support this
	case networking.ClientTLSSettings_MUTUAL:
		// TODO support this
	case networking.ClientTLSSettings_ISTIO_MUTUAL:
		tlsCtx := buildUpstreamTLSContext(b.push.ServiceAccounts(b.hostname, b.svc.Attributes.Namespace))
		c.TransportSocket = &core.TransportSocket{
			Name:       transportSocketName,
			ConfigType: &core.TransportSocket_TypedConfig{TypedConfig: protoconv.MessageToAny(tlsCtx)},
		}

	}{
		{
			name:    "Kubernetes service and EDS ServiceEntry",
			objs:    []runtime.Object{service, pod, endpoint},
			configs: []config.Config{dr, seEDS},
			// The ServiceEntry rule will "win" the pushContext.ServiceAccounts.
			// However, the Service will be processed first into a cluster. Since its not external, we do not add the SANs automatically
			sans: nil,
		},
		{
			name:    "Kubernetes service and NONE ServiceEntry",

	Service                        = schema.GroupVersionResource{Group: "", Version: "v1", Resource: "services"}
	ServiceAccount                 = schema.GroupVersionResource{Group: "", Version: "v1", Resource: "serviceaccounts"}
	ServiceEntry                   = schema.GroupVersionResource{Group: "networking.istio.io", Version: "v1alpha3", Resource: "serviceentries"}

    builtin: true
    specless: true
    proto: "k8s.io.api.core.v1.ConfigMap"
    protoPackage: "k8s.io/api/core/v1"

  - kind: "ServiceAccount"
    plural: "serviceaccounts"
    version: "v1"
    builtin: true
    specless: true
    proto: "k8s.io.api.core.v1.ServiceAccount"
    protoPackage: "k8s.io/api/core/v1"

  - kind: "CertificateSigningRequest"
    plural: "certificatesigningrequests"

			},
			BootstrapToken: &kubeoptions.BootstrapTokenAuthenticationOptions{},
			OIDC:           s.Authentication.OIDC,
			RequestHeader:  &apiserveroptions.RequestHeaderAuthenticationOptions{},
			ServiceAccounts: &kubeoptions.ServiceAccountAuthenticationOptions{
				Lookup:           true,
				ExtendExpiration: true,
			},
			TokenFile:            &kubeoptions.TokenFileAuthenticationOptions{},

	if s.Image.PullSecret != "" {
		if err := c.ApplyYAMLFiles(n.name, s.Image.PullSecret); err != nil {
			return err
		}
		err := retry.UntilSuccess(func() error {
			_, err := c.Kube().CoreV1().ServiceAccounts(n.name).Patch(context.TODO(),
				"default",
				types.JSONPatchType,
				[]byte(`[{"op": "add", "path": "/imagePullSecrets", "value": [{"name": "test-gcr-secret"}]}]`),
				metav1.PatchOptions{})
			return err

}

func generateECDSAToken(t *testing.T, iss string, serviceAccount *v1.ServiceAccount, ecdsaSecret *v1.Secret) string {
	t.Helper()

	ecdsaGenerator, err := serviceaccount.JWTTokenGenerator(iss, getPrivateKey(ecdsaPrivateKey))
	if err != nil {
		t.Fatalf("error making generator: %v", err)
	}
	ecdsaToken, err := ecdsaGenerator.GenerateToken(serviceaccount.LegacyClaims(*serviceAccount, *ecdsaSecret))
	if err != nil {

				},
				BootstrapToken: &kubeoptions.BootstrapTokenAuthenticationOptions{},
				OIDC:           s.Authentication.OIDC,
				RequestHeader:  &apiserveroptions.RequestHeaderAuthenticationOptions{},
				ServiceAccounts: &kubeoptions.ServiceAccountAuthenticationOptions{
					Lookup:           true,
					ExtendExpiration: true,
				},
				TokenFile:            &kubeoptions.TokenFileAuthenticationOptions{},

    # Default behavior: latest images will be Always else IfNotPresent.
    imagePullPolicy: ""

    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
    # to use for pulling any images in pods that reference this ServiceAccount.
    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.

				return
			}
		case allSvcAcctsFile:
			serviceAccounts := make(map[string]UserIdentity)
			err := globalIAMSys.store.loadUsers(ctx, svcUser, serviceAccounts)
			if err != nil {
				writeErrorResponse(ctx, w, exportError(ctx, err, iamFile, ""), r.URL)
				return
			}
			svcAccts := make(map[string]madmin.SRSvcAccCreate)
			for user, acc := range serviceAccounts {
				if user == siteReplicatorSvcAcc {