String scrollId = response.getScrollId();
        int count = 0;
        try {
            while (scrollId != null) {
                final SearchHit[] hits = response.getHits().getHits();
                if (hits.length == 0) {
                    break;
                }

                count += hits.length;
                final BulkResponse bulkResponse = get(c -> {

However, the identities of the certificates will be of the actual user workloads, not Ztunnel's own identity.
This means Ztunnel will have multiple distinct certificates at a time, one for each unique identity (service account) running on its node.

When fetching certificates, ztunnel will authenticate to the CA with its own identity, but request the identity of another workload.

* The `kube-cloud-controller-manager` flag `--service-account-private-key-file` was non-functional and is now deprecated. ([#50289](https://github.com/kubernetes/kubernetes/pull/50289), [@liggitt](https://github.com/liggitt))
    * The `kube-cloud-controller-manager` flag `--use-service-account-credentials` is now honored consistently, regardless of whether `--service-account-private-key-file` was specified.

https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ ## podDisruptionBudget: enabled: false maxUnavailable: 1 ## Specify the service account to use for the MinIO pods. If 'create' is set to 'false' ## and 'name' is left unspecified, the account 'default' will be used. serviceAccount: create: true ## The name of the service account to use. If 'create' is 'true', a service account with that name ## will be created. name: "minio-sa" metrics: serviceMonitor: enabled: false public: true additionalLabels: {}...

        bi += 4;
        sid = new SID(buf, bi);
        return size;
    }

    void appendCol(StringBuffer sb, String str, int width) {
        sb.append(str);
        int count = width - str.length();
        for (int i = 0; i < count; i++) {
            sb.append(' ');
        }
    }
    /**
     * Return a string represeting this ACE.
     * <p>

    counter.write(data, 2, 5);
    written += 5;
    assertEquals(written, out.size());
    assertEquals(written, counter.getCount());

    // Test that illegal arguments do not affect count
    assertThrows(IndexOutOfBoundsException.class, () -> counter.write(data, 0, data.length + 1));
    assertEquals(written, out.size());
    assertEquals(written, counter.getCount());
  }

  optional int32 replicas = 1;

  // selector is a label query over pods that should match the replicas count. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
  // +optional
  map<string, string> selector = 2;

  // targetSelector is the label selector for pods that should match the replicas count. This is a serializated
  // version of both map-based and more expressive set-based selectors. This is done to

	for _, hash := range formatHashes {
		if hash == "" {
			continue
		}
		formatCountMap[hash]++
	}

	maxHash := ""
	maxCount := 0
	for hash, count := range formatCountMap {
		if count > maxCount {
			maxCount = count
			maxHash = hash
		}
	}

	if maxCount < len(formats)/2 {
		return nil, errErasureReadQuorum
	}

	for i, hash := range formatHashes {
		if hash == maxHash {

	filter := func(list []uint64) (commonCount uint64) {
		max := 0
		signatureMap := map[uint64]int{}
		for _, v := range list {
			signatureMap[v]++
		}
		for ops, count := range signatureMap {
			if max < count && commonCount < ops {
				max = count
				commonCount = ops
			}
		}
		if max < readQuorum {
			return 0
		}
		return commonCount
	}

	commonWrite = filter(writes)

	QueueLength int

	// TotalMessages is the total number of messages sent in the lifetime of the target
	TotalMessages int64

	// FailedMessages should log message count that failed to send.
	FailedMessages int64