mode = 0600
			}

			var auds []string
			if len(tp.Audience) != 0 {
				auds = []string{tp.Audience}
			}
			tr, err := s.plugin.getServiceAccountToken(s.pod.Namespace, s.pod.Spec.ServiceAccountName, &authenticationv1.TokenRequest{
				Spec: authenticationv1.TokenRequestSpec{
					Audiences:         auds,
					ExpirationSeconds: tp.ExpirationSeconds,

		manager, err := NewManager(ctx, ManagerOptions{
			Dialer: dialer.DialContext,
			Local:  host,
			Hosts:  hosts,
			AuthRequest: func(r *http.Request) error {
				return nil
			},
			AddAuth:      func(aud string) string { return aud },
			BlockConnect: ready,
		})
		if err != nil {
			return nil, err
		}
		m := mux.NewRouter()
		m.Handle(RoutePath, manager.Handler())
		res.Managers = append(res.Managers, manager)

      },
      "statusPort": 15020,
      "tracer": "none"
    },
    "proxy_init": {
      "image": "proxyv2"
    },
    "remotePilotAddress": "",
    "sds": {
      "token": {
        "aud": "istio-ca"
      }
    },
    "sts": {
      "servicePort": 0
    },
    "tag": "latest",
    "variant": ""
  },
  "istio_cni": {
    "chained": true,
    "enabled": false,

      },
      "statusPort": 15020,
      "tracer": "none"
    },
    "proxy_init": {
      "image": "proxyv2"
    },
    "remotePilotAddress": "",
    "sds": {
      "token": {
        "aud": "istio-ca"
      }
    },
    "sts": {
      "servicePort": 0
    },
    "tag": "latest",
    "variant": ""
  },
  "istio_cni": {
    "chained": true,
    "enabled": true,
    "provider": "multus"

      },
      "statusPort": 15020,
      "tracer": "none"
    },
    "proxy_init": {
      "image": "proxyv2"
    },
    "remotePilotAddress": "",
    "sds": {
      "token": {
        "aud": "istio-ca"
      }
    },
    "sts": {
      "servicePort": 0
    },
    "tag": "latest",
    "variant": ""
  },
  "istio_cni": {
    "chained": true,
    "enabled": false,

      },
      "statusPort": 15020,
      "tracer": "none"
    },
    "proxy_init": {
      "image": "proxyv2"
    },
    "remotePilotAddress": "",
    "sds": {
      "token": {
        "aud": "istio-ca"
      }
    },
    "sts": {
      "servicePort": 0
    },
    "tag": "latest",
    "variant": ""
  },
  "istio_cni": {
    "chained": true,
    "enabled": true,
    "provider": "default"

      },
      "statusPort": 123,
      "tracer": "none"
    },
    "proxy_init": {
      "image": "proxyv2"
    },
    "remotePilotAddress": "",
    "sds": {
      "token": {
        "aud": "istio-ca"
      }
    },
    "sts": {
      "servicePort": 0
    },
    "tag": "latest",
    "variant": ""
  },
  "istio_cni": {
    "chained": true,
    "enabled": false,

	//
	// - MatchAny: the "aud" claim in the presented JWT must match at least one of the entries in the "audiences" field.
	// For example, if "audiences" is ["foo", "bar"], the "aud" claim in the presented JWT must contain either "foo" or "bar" (and may contain both).
	//

		}
		authn := serviceaccount.JWTTokenAuthenticator([]string{serviceaccount.LegacyIssuer, "bar"}, tc.Keys, auds, validator)

		// An invalid, non-JWT token should always fail
		ctx := authenticator.WithAudiences(context.Background(), auds)
		if _, ok, err := authn.AuthenticateToken(ctx, "invalid token"); err != nil || ok {
			t.Errorf("%s: Expected err=nil, ok=false for non-JWT token", k)

	//
	// - MatchAny: the "aud" claim in the presented JWT must match at least one of the entries in the "audiences" field.
	// For example, if "audiences" is ["foo", "bar"], the "aud" claim in the presented JWT must contain either "foo" or "bar" (and may contain both).
	//