byte[] ivec = new byte[8];
        IvParameterSpec params = new IvParameterSpec(ivec);

        SecretKeySpec skSpec = new SecretKeySpec(key.getEncoded(), "DES");
        SecretKey sk = skSpec;

        cipher.init(Cipher.DECRYPT_MODE, sk, params);

        byte[] result;
        result = cipher.doFinal(data);

        decrypt = new byte[result.length];
        System.arraycopy(result, 0, decrypt, 0, result.length);

//    Rule: Never break between consecutive runes of this category.
//
// 2) Mid:
//    MidLetter, MidNumLet, Single_Quote.
//    (Cf. case-ignorable: MidLetter, MidNumLet, Single_Quote or cat is Mn,
//    Me, Cf, Lm or Sk).
//    Rule: Don't break between Letter and Mid, but break between two Mids.
//
// 3) Break:
//    Any other category: NewLine, MidNum, CR, LF, Double_Quote, Katakana, and
//    Other.

qu: Runa Simi
rm: rumantsch grischun
rn: Ikirundi
ro: Română
ru: русский язык
rw: Ikinyarwanda
sa: संस्कृतम्
sc: sardu
sd: सिन्धी
se: Davvisámegiella
sg: yângâ tî sängö
si: සිංහල
sk: slovenčina
sl: slovenščina
sn: chiShona
so: Soomaaliga
sq: shqip
sr: српски језик
ss: SiSwati
st: Sesotho
su: Basa Sunda
sv: svenska
sw: Kiswahili
ta: தமிழ்
te: తెలుగు
tg: тоҷикӣ

			}
		}
	}

	if completed.ServiceAccountSigningKeyFile != "" && len(completed.Authentication.ServiceAccounts.Issuers) != 0 && completed.Authentication.ServiceAccounts.Issuers[0] != "" {
		sk, err := keyutil.PrivateKeyFromFile(completed.ServiceAccountSigningKeyFile)
		if err != nil {
			return CompletedOptions{}, fmt.Errorf("failed to parse service-account-issuer-key-file: %v", err)
		}

	}
	if s.SkipTProxy {
		s.SkipWorkloadClasses = append(s.SkipWorkloadClasses, "tproxy")
	}
	// Allow passing a single CSV flag as well
	normalized := make(ArrayFlags, 0)
	for _, sk := range s.SkipWorkloadClasses {
		normalized = append(normalized, strings.Split(sk, ",")...)
	}
	s.SkipWorkloadClasses = normalized

	if s.Image.Hub == "" {
		s.Image.Hub = env.HUB.ValueOrDefault("gcr.io/istio-testing")
	}

	if s.Image.Tag == "" {

			if ep.Labels == nil {
				ep.Labels = make(map[string]string)
			}
			ep.Labels["app"] = "example"
			ep.Locality.ClusterID = sk.Cluster
			shards.Shards[sk][i] = ep
		}
	}
	// convert to EndpointIndex
	index := model.NewEndpointIndex(model.NewXdsCache())
	for shardKey, testEps := range shards.Shards {
		svc, _ := index.GetOrCreateEndpointShard("example.ns.svc.cluster.local", "ns")
		svc.Lock()
		svc.Shards[shardKey] = testEps

000002e0  69 4b a8 51 ee de b3 b0  f7 1a 57 a3 28 72 d2 13  |iK.Q......W.(r..|
000002f0  a6 d3 17 0b c4 45 34 7f  10 3b 81 cb 0c 8d 51 b6  |.....E4..;....Q.|
00000300  0b 86 21 d0 ee 1d 7e 73  6b ea 77 8c 66 dc 65 16  |..!...~sk.w.f.e.|
00000310  03 03 00 04 0e 00 00 00                           |........|
>>> Flow 3 (client to server)
00000000  16 03 03 00 25 10 00 00  21 20 ed 3e ba a7 43 53  |....%...! .>..CS|

00000110  a9 54 af 0b 55 e2 d3 35  73 56 9b 9a 19 fd 93 9a  |.T..U..5sV......|
00000120  21 c3 5f f8 cf fe e0 a1  63 62 b8 58 bf 35 29 1d  |!._.....cb.X.5).|
00000130  69 58 f6 d3 e8 60 66 1b  db 53 4b 26 0b 78 d9 5e  |iX...`f..SK&.x.^|
00000140  73 d5 34 5a 11 57 98 8d  0c 9f 85 28 80 a4 ee 47  |s.4Z.W.....(...G|
00000150  f8 23 ca 31 7a 24 d5 dd  9b 49 7b 62 ab e5 69 fa  |.#.1z$...I{b..i.|

00000030  cf 42 b5                                          |.B.|
>>> Flow 5 (client to server)
00000000  17 03 03 00 1e 00 00 00  00 00 00 00 01 53 4b a2  |.............SK.|
00000010  e4 5f 51 70 46 3d e3 41  28 8b 82 02 e2 27 8d eb  |._QpF=.A(....'..|
00000020  42 65 7f 15 03 03 00 1a  00 00 00 00 00 00 00 02  |Be..............|

// nolint: unparam
func (a *Agent) getWorkloadCerts(st *cache.SecretManagerClient) (sk *security.SecretItem, err error) {
	b := backoff.NewExponentialBackOff(backoff.DefaultOption())
	// This will loop forever until success
	err = b.RetryWithContext(context.TODO(), func() error {
		sk, err = st.GenerateSecret(security.WorkloadKeyCertResourceName)
		if err == nil {
			return nil
		}