func genSpiffeURI(td string, ns, serviceAccount string) (string, error) {
	var err error
	if ns == "" || serviceAccount == "" {
		err = fmt.Errorf(
			"namespace or service account empty for SPIFFE uri ns=%v serviceAccount=%v", ns, serviceAccount)
	}
	return URIPrefix + sanitizeTrustDomain(td) + "/ns/" + ns + "/sa/" + serviceAccount, err
}

	locality := util.LocalityToString(proxy.Locality)
	out := &EndpointBuilder{
		controller:     c,
		metaNetwork:    proxy.Metadata.Network,
		serviceAccount: proxy.Metadata.ServiceAccount,
		locality: model.Locality{
			Label:     locality,
			ClusterID: c.Cluster(),
		},
		tlsMode:  model.GetTLSModeFromEndpointLabels(proxy.Labels),
		nodeName: proxy.GetNodeName(),
	}

	createCmd.PersistentFlags().StringVarP(&serviceAccount, "serviceAccount", "s", "default", "The service identity to associate with the workload instances")
	_ = createCmd.RegisterFlagCompletionFunc("serviceAccount", func(
		cmd *cobra.Command, args []string, toComplete string,
	) ([]string, cobra.ShellCompDirective) {

			namespace:      "foo",
			serviceAccount: "bar",
			trustDomain:    "******@****.***.gserviceaccount.com",
			expectedURI:    "spiffe://kube-federating-id.testproj.iam.gserviceaccount.com/ns/foo/sa/bar",
		},
	}
	for id, tc := range testCases {
		got, err := genSpiffeURI(tc.trustDomain, tc.namespace, tc.serviceAccount)
		if tc.expectedError == "" && err != nil {
			t.Errorf("teste case [%v] failed, error %v", id, tc)
		}

			continue
		}
		if proxy.Metadata.ServiceAccount != "" && spiffeID.ServiceAccount != proxy.Metadata.ServiceAccount {
			continue
		}
		return &spiffeID, nil
	}
	return nil, fmt.Errorf("no identities (%v) matched %v/%v", identities, proxy.ConfigNamespace, proxy.Metadata.ServiceAccount)

			if completed.Authentication.ServiceAccounts.MaxExpiration < lowBound ||
				completed.Authentication.ServiceAccounts.MaxExpiration > upBound {
				return CompletedOptions{}, fmt.Errorf("the service-account-max-token-expiration must be between 1 hour and 2^32 seconds")
			}
			if completed.Authentication.ServiceAccounts.ExtendExpiration {

	case ReferenceGrant:
		return "ReferenceGrant"
	case RequestAuthentication:
		return "RequestAuthentication"
	case Secret:
		return "Secret"
	case Service:
		return "Service"
	case ServiceAccount:
		return "ServiceAccount"
	case ServiceEntry:
		return "ServiceEntry"
	case Sidecar:
		return "Sidecar"
	case StatefulSet:
		return "StatefulSet"
	case TCPRoute:
		return "TCPRoute"
	case TLSRoute:

{{- if .ServiceAccount }}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ .Service }}
---
{{- end }}
apiVersion: v1
kind: Service
metadata:
  name: {{ .Service }}
{{- if .ServiceLabels }}
  labels:
    app: {{ .Service }}
{{- range $name, $value := .ServiceLabels }}
    {{$name}}: "{{$value}}"
{{- end }}
{{- else}}
  labels:
    app: {{ .Service }}
{{- end }}
{{- if .ServiceAnnotations }}
  annotations:

					Namespace:         testNS,
					Addresses:         [][]byte{parseIP("140.140.0.10")},
					Network:           testNW,
					CanonicalName:     "a",
					CanonicalRevision: "latest",
					ServiceAccount:    "sa1",
					WorkloadType:      workloadapi.WorkloadType_POD,
					WorkloadName:      "name0",
					ClusterId:         testC,
				},
			},
		},
	}})

roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:network-policies
subjects:
- kind: ServiceAccount
  name: kube-network-policies
  namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kube-network-policies
  namespace: kube-system
  labels:
    k8s-app: kube-network-policies
    kubernetes.io/cluster-service: "true"