privileged: false
          readOnlyRootFilesystem: true
        volumeMounts:
        - mountPath: /var/run/secrets/workload-spiffe-uds
          name: workload-socket
        - mountPath: /var/run/secrets/credential-uds
          name: credential-socket
        - mountPath: /var/run/secrets/workload-spiffe-credentials
          name: workload-certs
        - mountPath: /etc/istio/proxy
          name: istio-envoy

		if kerrors.IsAlreadyExists(err) {
			if _, err := kubeAccessor.Kube().CoreV1().Secrets(namespace.Name()).Update(context.TODO(), secret, metav1.UpdateOptions{}); err != nil {
				return fmt.Errorf("failed updating secret %s: %v", secret.Name, err)
			}
		} else {
			return fmt.Errorf("failed creating secret %s: %v", secret.Name, err)
		}
	}
	return nil
}

func ReadCustomCertFromFile(certsPath string, f string) ([]byte, error) {

	// Each key has to be 32 bytes long.
	Keys []Key `json:"keys"`
}

// Key contains name and secret of the provided key for a transformer.
type Key struct {
	// name is the name of the key to be used while storing data to disk.
	Name string `json:"name"`
	// secret is the actual key, encoded in base64.
	Secret string `json:"secret"`
}

// String implements Stringer interface in a log safe way.
func (k Key) String() string {

          privileged: false
          readOnlyRootFilesystem: true
        volumeMounts:
        - mountPath: /var/run/secrets/workload-spiffe-uds
          name: workload-socket
        - mountPath: /var/run/secrets/credential-uds
          name: credential-socket
        - mountPath: /var/run/secrets/workload-spiffe-credentials
          name: workload-certs
        - mountPath: /etc/istio/proxy
          name: istio-envoy

kind: EncryptionConfiguration
apiVersion: apiserver.config.k8s.io/v1
resources:
  - resources:
      - secrets
    providers:
      - aesgcm:
          keys:
            - name: key1

- |
  **Improved** Pilot will now load its DNS serving certificate from well known locations:
  ```
  /var/run/secrets/istiod/tls/tls.crt
  /var/run/secrets/istiod/tls/tls.key
  /var/run/secrets/istiod/ca/root-cert.pem
  ```
  The CA path will alternatively be loaded from: `/var/run/secrets/tls/ca.crt`
  It also automatically loads any secret called istiod-tls and the istio-root-ca-configmap into those paths.

kind: EncryptionConfiguration
apiVersion: apiserver.config.k8s.io/v1
resources:
  - resources:
      - secrets
    providers:
    - aesgcm:
        keys:
        - name: key1

                      path: secrets/{{ tpl .existingSecret $ }}/{{ tpl .existingSecretKey $ }}
              {{- end }}
              {{- end }}
              {{- range ( default list .Values.svcaccts ) }}
              {{- if .existingSecret }}
              - secret:
                  name: {{ tpl .existingSecret $ }}
                  items:
                    - key: {{ .existingSecretKey }}

			log.Infof("IstioGenerated %s secret found, use it as the CA certificate", ca.CACertsSecret)

			// TODO(jaellio): Currently, when the USE_CACERTS_FOR_SELF_SIGNED_CA flag is true istiod
			// handles loading and updating the "cacerts" secret with the "istio-generated" key the
			// same way it handles the "istio-ca-secret" secret. Isitod utilizes a secret watch instead

}

// Key contains name and secret of the provided key for a transformer.
type Key struct {
	// name is the name of the key to be used while storing data to disk.
	Name string
	// secret is the actual key, encoded in base64.
	Secret string
}

// String implements Stringer interface in a log safe way.
func (k Key) String() string {
	return fmt.Sprintf("Name: %s, Secret: [REDACTED]", k.Name)
}