- name: istio-token
    projected:
      sources:
      - serviceAccountToken:
          path: istio-token
          expirationSeconds: 43200
          audience: {{ .Values.global.sds.token.aud }}
  {{- if eq .Values.global.pilotCertProvider "istiod" }}
  - name: istiod-ca-cert
    configMap:
      name: istio-ca-root-cert
  {{- end }}
  {{- if .Values.global.mountMtlsCerts }}

func (c *Client) Close() {
	atomic.StoreInt32(&c.connected, closed)
}

// NewClient - returns new REST client.
func NewClient(uu *url.URL, tr http.RoundTripper, newAuthToken func(aud string) string) *Client {
	connected := int32(online)
	urlStr := uu.String()
	u, err := url.Parse(urlStr)
	if err != nil {
		// Mark offline, with no reconnection attempts.
		connected = int32(offline)

  - name: istio-token
    projected:
      sources:
      - serviceAccountToken:
          path: istio-token
          expirationSeconds: 43200
          audience: {{ .Values.global.sds.token.aud }}
  {{- if eq .Values.global.pilotCertProvider "istiod" }}
  - name: istiod-ca-cert
    configMap:
      name: istio-ca-root-cert
  {{- end }}
  {{- if eq .Values.global.pilotCertProvider "kubernetes" }}

  - name: istio-token
    projected:
      sources:
      - serviceAccountToken:
          path: istio-token
          expirationSeconds: 43200
          audience: {{ .Values.global.sds.token.aud }}
  {{- if eq .Values.global.pilotCertProvider "istiod" }}
  - name: istiod-ca-cert
    configMap:
      name: istio-ca-root-cert
  {{- end }}
  {{- if eq .Values.global.pilotCertProvider "kubernetes" }}

	customTokenIdentity = "AssumeRoleWithCustomToken"
	assumeRole          = "AssumeRole"

	stsRequestBodyLimit = 10 * (1 << 20) // 10 MiB

	// JWT claim keys
	expClaim = "exp"
	subClaim = "sub"
	audClaim = "aud"
	issClaim = "iss"

	// JWT claim to check the parent user
	parentClaim = "parent"

	// LDAP claim keys
	ldapUser  = "ldapUser"     // this is a key name for a DN value

and "istiod". # As some platforms may not have kubernetes signing APIs, # Istiod is the default pilotCertProvider: istiod sds: # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3. # When a CSR is sent from Citadel Agent to the CA (e.g. Citadel), this aud is to make sure the # JWT is intended for the CA. token: aud: istio-ca sts: # The service port used by Security Token Service (STS) server to handle token exchange requests. # Setting this port to a non-zero value enables...

If,OAAOwe,GAGRhD,IAAK,SAAUte,EAAM8C,GACpB,IAAIu4B,EAAWnZ,EACdnhB,EAAUf,EAAKe,QACfugB,EAAS3iB,EAAO2D,UAAWQ,GAC3BhF,EAAIiD,EAAQ9B,OAEb,MAAQnB,MACPokB,EAASnhB,EAASjD,IAIN4T,UACuD,EAAlE/S,EAAO6D,QAAS7D,EAAOy8B,SAASlZ,OAAO5iB,IAAK4iB,GAAUZ,MAEtD+Z,GAAY,GAUd,OAHMA,IACLr7B,EAAK2R,eAAiB,GAEhB2P,OAOX3iB,EAAOkB,KAAM,CAAE,QAAS,YAAc,WACrClB,EAAOy8B,SAAUz/B,MAAS,CACzB2iB,IAAK,SAAUte,EAAM8C,GACpB,GAAKvB,MAAMC,QAASsB,GACnB,OAAS9C,EAAKyR,SAA2D,EAAjD9S,EAAO6D,QAAS7D,EAAQqB,GAAOjC,MAAO+E,KAI3D/F,EAAQu8B,UACb36B,E...

If,OAAOwe,GAGRhD,IAAK,SAAUte,EAAM8C,GACpB,IAAIu4B,EAAWnZ,EACdnhB,EAAUf,EAAKe,QACfugB,EAAS3iB,EAAO2D,UAAWQ,GAC3BhF,EAAIiD,EAAQ9B,OAEb,MAAQnB,MACPokB,EAASnhB,EAASjD,IAIN4T,UACuD,EAAlE/S,EAAO6D,QAAS7D,EAAOy8B,SAASlZ,OAAO5iB,IAAK4iB,GAAUZ,MAEtD+Z,GAAY,GAUd,OAHMA,IACLr7B,EAAK2R,eAAiB,GAEhB2P,OAOX3iB,EAAOkB,KAAM,CAAE,QAAS,YAAc,WACrClB,EAAOy8B,SAAUz/B,MAAS,CACzB2iB,IAAK,SAAUte,EAAM8C,GACpB,GAAKvB,MAAMC,QAASsB,GACnB,OAAS9C,EAAKyR,SAA2D,EAAjD9S,EAAO6D,QAAS7D,EAAQqB,GAAOjC,MAAO+E,KAI3D/F,EAAQu8B,UACb36B,E...