- Check that `account` client_id has the role 'admin' assigned in the "Service Account Roles" tab.

After that, you will be able to obtain an id_token for the Admin REST API using client_id and client_secret:

```
curl \

	serviceList, err := client.Kube().CoreV1().Services(ns).List(context.Background(), metav1.ListOptions{})
	if err != nil {
		return nil, err
	}

	var serviceNameList []string
	for _, service := range serviceList.Items {
		if toComplete == "" || strings.HasPrefix(service.Name, toComplete) {
			serviceNameList = append(serviceNameList, service.Name)
		}
	}

	return serviceNameList, nil
}

				logger.Info("Restarting on service signal")
				daemon.SdNotify(false, daemon.SdNotifyReloading)
				stop := stopProcess()
				rerr := restartProcess()
				if rerr == nil {
					daemon.SdNotify(false, daemon.SdNotifyReady)
				}
				shutdownLogIf(context.Background(), rerr)
				exit(stop && rerr == nil)
			case serviceStop:
				logger.Info("Stopping on service signal")

 * specific language governing permissions and limitations
 * under the License.
 */
package org.apache.maven.api.services;

import java.util.Collection;
import java.util.List;

import org.apache.maven.api.ArtifactCoordinates;
import org.apache.maven.api.RemoteRepository;
import org.apache.maven.api.Service;
import org.apache.maven.api.Session;
import org.apache.maven.api.annotations.Experimental;

/**

Istio Version:       1.21.0-1226
Istio Proxy Version: ee85c5f28702f00621aed895915fca565796b9e4
Envoy Version:       0.0.0

NAME                                                                SERVICE FQDN                          PORT     SUBSET     DIRECTION       TYPE       DESTINATION RULE
cluster/agent                                                       cluster/agent                         -        -          -               STATIC     

    release: istio
  name: istio-sidecar-injector-1-16
webhooks:
  - admissionReviewVersions:
      - v1beta1
      - v1
    clientConfig:
      service:
        name: istiod-1-16
        namespace: istio-system
        path: /inject
        port: 443
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: rev.namespace.sidecar-injector.istio.io

			excludePorts += fmt.Sprintf(",%d", config.StatusPort)
		} else {
			// use default status port
			excludePorts += ",15020"
		}
	}
	// default attributes and service name, namespace, ports, service account, service CIDR
	overrides := map[string]string{
		"ISTIO_INBOUND_PORTS":       portBehavior,
		"ISTIO_NAMESPACE":           wg.Namespace,

kind: Ingress
metadata:
  name: {{ $fullName }}
  labels:
    app: {{ template "minio.name" . }}
    chart: {{ template "minio.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    {{- with .Values.consoleIngress.labels }}
      {{- toYaml . | nindent 4 }}
    {{- end }}
  {{- with .Values.consoleIngress.annotations }}
  annotations: {{- toYaml . | nindent 4 }}
  {{- end }}
spec:

  namespace: {{ .Values.metrics.serviceMonitor.namespace }}
  {{- end }}
  labels:
    app: {{ template "minio.name" . }}
    chart: {{ template "minio.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    {{- if .Values.metrics.serviceMonitor.additionalLabels }}
      {{- toYaml .Values.metrics.serviceMonitor.additionalLabels | nindent 4 }}
    {{- end }}
  {{- if .Values.metrics.serviceMonitor.annotations }}

    final CyclicBarrier barrier = new CyclicBarrier(2);
    // we need to make sure the error gets thrown on a different thread.
    ExecutorService service = Executors.newSingleThreadExecutor();
    try {
      final SequentialExecutor executor = new SequentialExecutor(service);
      Runnable errorTask =
          new Runnable() {
            @Override
            public void run() {
              throw new MyError();