diff --git a/kubernetes/customresourcedefinitions.gen.yaml b/kubernetes/customresourcedefinitions.gen.yaml
index 0387315da46..93a1d56c97d 100644
--- a/kubernetes/customresourcedefinitions.gen.yaml
+++ b/kubernetes/customresourcedefinitions.gen.yaml
@@ -5519,6 +5519,12 @@ spec:
                                   format: string
                                   type: string
                                 type: array
+                              trustDomains:
+                                description: Optional.
+                                items:
+                                  format: string
+                                  type: string
+                                type: array
                             type: object
                         type: object
                       type: array
diff --git a/mesh/v1alpha1/config.pb.go b/mesh/v1alpha1/config.pb.go
index 77a121b1575..fbfce4052c3 100644
--- a/mesh/v1alpha1/config.pb.go
+++ b/mesh/v1alpha1/config.pb.go
@@ -897,10 +897,16 @@ type MeshConfig_CertificateData struct {
 	// Types that are valid to be assigned to CertificateData:
 	//	*MeshConfig_CertificateData_Pem
 	//	*MeshConfig_CertificateData_SpiffeBundleUrl
-	CertificateData      isMeshConfig_CertificateData_CertificateData `protobuf_oneof:"certificate_data"`
-	XXX_NoUnkeyedLiteral struct{}                                     `json:"-"`
-	XXX_unrecognized     []byte                                       `json:"-"`
-	XXX_sizecache        int32                                        `json:"-"`
+	CertificateData isMeshConfig_CertificateData_CertificateData `protobuf_oneof:"certificate_data"`
+	// Optional. Specify the list of trust domains to which this certificate data belongs.
+	// If set, they are used for this root CA. Otherwise, this root CA is used for default trust domain
+	// and its aliases.
+	// Note that we can have multiple certificate data for a same trust_domain.
+	// In that case, certificates with a same trust domain will be merged and used together to verify peer certificates.
+	TrustDomains         []string `protobuf:"bytes,3,rep,name=trust_domains,json=trustDomains,proto3" json:"trustDomains,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
 }
 
 func (m *MeshConfig_CertificateData) Reset()         { *m = MeshConfig_CertificateData{} }
@@ -973,6 +979,13 @@ func (m *MeshConfig_CertificateData) GetSpiffeBundleUrl() string {
 	return ""
 }
 
+func (m *MeshConfig_CertificateData) GetTrustDomains() []string {
+	if m != nil {
+		return m.TrustDomains
+	}
+	return nil
+}
+
 // XXX_OneofWrappers is for the internal use of the proto package.
 func (*MeshConfig_CertificateData) XXX_OneofWrappers() []interface{} {
 	return []interface{}{
@@ -2564,207 +2577,208 @@ func init() {
 func init() { proto.RegisterFile("mesh/v1alpha1/config.proto", fileDescriptor_b5c7ece76d5d5022) }
 
 var fileDescriptor_b5c7ece76d5d5022 = []byte{
-	// 3194 bytes of a gzipped FileDescriptorProto
+	// 3207 bytes of a gzipped FileDescriptorProto
 	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xc4, 0x5a, 0xcd, 0x72, 0x1b, 0x49,
-	0x72, 0x16, 0x40, 0x48, 0x6c, 0x26, 0x08, 0xb2, 0x59, 0x14, 0xa5, 0x26, 0xf4, 0x47, 0x71, 0x46,
-	0x1a, 0xae, 0x3c, 0x06, 0x47, 0xd4, 0xec, 0xac, 0x76, 0xd6, 0x61, 0x1b, 0x04, 0x20, 0x89, 0x18,
-	0x88, 0xa4, 0x9b, 0xa0, 0x34, 0x3f, 0xb1, 0x51, 0x51, 0xe8, 0x2e, 0x00, 0xbd, 0x6c, 0x74, 0xc1,
-	0x55, 0x05, 0x8a, 0x98, 0x88, 0x7d, 0x02, 0x9f, 0x7c, 0x72, 0xf8, 0x19, 0x1c, 0xf6, 0xc1, 0x17,
-	0xbf, 0x82, 0x23, 0xf6, 0xe2, 0xc3, 0x1e, 0x7d, 0x70, 0xcc, 0xd9, 0x0f, 0xe1, 0xa8, 0x9f, 0x06,
-	0x40, 0x12, 0x23, 0x88, 0x13, 0xb3, 0xde, 0x1b, 0x3a, 0x2b, 0xf3, 0xcb, 0xac, 0xac, 0xcc, 0xac,
-	0xac, 0x2a, 0x40, 0xb1, 0x47, 0x45, 0x77, 0xfb, 0xf4, 0x29, 0x89, 0xfb, 0x5d, 0xf2, 0x74, 0x3b,
-	0x60, 0x49, 0x3b, 0xea, 0x94, 0xfa, 0x9c, 0x49, 0x86, 0x56, 0x23, 0x21, 0x23, 0x56, 0x52, 0x1c,
-	0xa5, 0x94, 0xa3, 0x78, 0xbf, 0xc3, 0x58, 0x27, 0xa6, 0xdb, 0x9a, 0xa5, 0x35, 0x68, 0x6f, 0x87,
-	0x03, 0x4e, 0x64, 0xc4, 0x12, 0x23, 0x74, 0x79, 0xfc, 0x1d, 0x27, 0xfd, 0x3e, 0xe5, 0xc2, 0x8e,
-	0xaf, 0x9f, 0x57, 0xd8, 0xe7, 0xec, 0x6c, 0x68, 0x87, 0x9e, 0x24, 0x54, 0xbe, 0x63, 0xfc, 0x24,
-	0x4a, 0x3a, 0x29, 0xc3, 0xb3, 0xed, 0x90, 0x0a, 0x19, 0x25, 0x5a, 0x03, 0xe6, 0x83, 0x98, 0x5a,
-	0xde, 0xcf, 0x4f, 0x9e, 0x8b, 0x52, 0xc4, 0xb6, 0x49, 0x3f, 0xea, 0x91, 0xa0, 0x1b, 0x25, 0x94,
-	0x0f, 0xb7, 0xfb, 0x27, 0x1d, 0x45, 0x10, 0xdb, 0x3d, 0x2a, 0xc9, 0xf6, 0xe9, 0xd3, 0xed, 0x0e,
-	0x4d, 0x28, 0x27, 0x92, 0x86, 0x46, 0x6a, 0xf3, 0x9f, 0xfe, 0x06, 0xe0, 0x35, 0x15, 0xdd, 0x8a,
-	0x9e, 0x26, 0x7a, 0x02, 0x2b, 0x5a, 0x3f, 0x8e, 0x23, 0x21, 0x69, 0x82, 0xfb, 0x8c, 0x4b, 0x2f,
-	0xb7, 0x91, 0xd9, 0xba, 0xee, 0x2f, 0xeb, 0x81, 0x86, 0xa6, 0x1f, 0x32, 0x2e, 0xd1, 0x63, 0x30,
-	0x24, 0xdc, 0x95, 0xb2, 0x6f, 0x38, 0xaf, 0x6b, 0xce, 0x82, 0x26, 0xbf, 0x92, 0xb2, 0xaf, 0xf9,
-	0x76, 0x61, 0x39, 0x60, 0x49, 0x42, 0x03, 0x89, 0x65, 0xd4, 0xa3, 0x6c, 0x20, 0xbd, 0x1b, 0x1b,
-	0x99, 0xad, 0xfc, 0xce, 0x7a, 0xc9, 0x78, 0xa6, 0x94, 0x7a, 0xa6, 0x54, 0xb5, 0x9e, 0xf3, 0x97,
-	0xac, 0x44, 0xd3, 0x08, 0xa0, 0xb7, 0x50, 0xd4, 0x4c, 0x01, 0x8b, 0x71, 0x48, 0x25, 0x0d, 0xf4,
-	0xec, 0x53, 0xb8, 0x27, 0xb3, 0xe0, 0xbc, 0x54, 0xb8, 0x9a, 0xca, 0xa6, 0xc0, 0x0c, 0x0a, 0x32,
-	0xe8, 0xe3, 0x13, 0x4a, 0xfb, 0x24, 0x8e, 0x4e, 0xa9, 0x77, 0x57, 0x63, 0xd5, 0x4b, 0x66, 0xa5,
-	0xc7, 0xfe, 0x4f, 0xd7, 0xfb, 0x59, 0xa9, 0x62, 0x4c, 0x8b, 0x58, 0x72, 0xc8, 0x58, 0x7c, 0x44,
-	0xa5, 0x8c, 0x92, 0x8e, 0x28, 0x35, 0x2b, 0x87, 0xe3, 0xdf, 0x41, 0xff, 0xab, 0x14, 0xd1, 0x5f,
-	0x94, 0x13, 0x5f, 0xe8, 0x23, 0x28, 0x44, 0x49, 0x87, 0x53, 0x21, 0x70, 0x10, 0x13, 0x21, 0xbc,
-	0xf9, 0x8d, 0xcc, 0xd6, 0x82, 0xbf, 0x68, 0x89, 0x15, 0x45, 0x43, 0x9f, 0xc0, 0x72, 0xca, 0x24,
-	0x28, 0x3f, 0x8d, 0x02, 0xea, 0x39, 0x9a, 0x6d, 0xc9, 0x92, 0x8f, 0x0c, 0x15, 0xf5, 0xe0, 0xf6,
-	0x08, 0x8d, 0x25, 0x92, 0xb3, 0x38, 0xa6, 0x1c, 0xf7, 0x58, 0x48, 0xbd, 0x85, 0x8d, 0xcc, 0xd6,
-	0xd2, 0xce, 0x2f, 0x4b, 0x53, 0x42, 0xb6, 0x34, 0x5e, 0xf1, 0xd2, 0x9e, 0xd5, 0x3b, 0x92, 0x7e,
-	0xcd, 0x42, 0xea, 0xaf, 0x45, 0xd3, 0xc8, 0xe8, 0x17, 0xe0, 0x8e, 0xed, 0x8a, 0x69, 0x20, 0x19,
-	0xf7, 0x3e, 0xd7, 0x86, 0x2d, 0x8f, 0x0c, 0x33, 0x64, 0xf4, 0x08, 0x96, 0x68, 0x42, 0x5a, 0x31,
-	0xc5, 0x92, 0x93, 0x20, 0x4a, 0x3a, 0xde, 0xe2, 0x46, 0x66, 0xcb, 0xf1, 0x0b, 0x86, 0xda, 0x34,
-	0x44, 0x15, 0x44, 0x24, 0x08, 0x14, 0x60, 0xcc, 0x3a, 0xb8, 0x1d, 0xc5, 0xd4, 0x2b, 0x68, 0xc0,
-	0x82, 0x21, 0x37, 0x58, 0xe7, 0x45, 0x14, 0x53, 0x15, 0x98, 0x93, 0x7c, 0x8c, 0xf7, 0x88, 0xf4,
-	0x3c, 0xa3, 0x7a, 0xcc, 0xa9, 0xc9, 0x88, 0xc0, 0xea, 0x04, 0x2f, 0x4d, 0x02, 0x16, 0x2a, 0xfd,
-	0x77, 0xb4, 0x43, 0x9e, 0xce, 0x72, 0x48, 0x39, 0x45, 0xab, 0x59, 0x41, 0x7f, 0x85, 0x5c, 0x24,
-	0xa1, 0x2a, 0x3c, 0xb0, 0xb3, 0xa3, 0xc9, 0x29, 0x1b, 0xe2, 0x09, 0x7d, 0xe9, 0x82, 0x6d, 0xe9,
-	0xe9, 0xde, 0x31, 0x6c, 0x35, 0xc5, 0x35, 0x42, 0x4e, 0x57, 0xef, 0x37, 0x50, 0x0c, 0x23, 0x31,
-	0x01, 0x63, 0xb2, 0x8e, 0x72, 0x05, 0xe4, 0x3d, 0xd7, 0x00, 0xb7, 0x2d, 0x87, 0x46, 0x68, 0xd8,
-	0xf1, 0x06, 0xeb, 0xa0, 0x97, 0xb0, 0x14, 0xd2, 0x36, 0x19, 0xc4, 0x12, 0x9b, 0x1a, 0xe5, 0x2d,
-	0xe9, 0xd0, 0xdd, 0x98, 0x3a, 0xc1, 0x43, 0x95, 0x92, 0x66, 0x86, 0x7e, 0xc1, 0xca, 0xd9, 0x9c,
-	0xef, 0xc1, 0x6d, 0x36, 0x90, 0x2d, 0x36, 0x48, 0x42, 0xb5, 0x56, 0xed, 0x76, 0x14, 0xe0, 0x3e,
-	0x8b, 0xa3, 0x60, 0xe8, 0xad, 0x68, 0xc4, 0x99, 0x31, 0x74, 0x60, 0xc5, 0x9b, 0x46, 0xfa, 0x50,
-	0x0b, 0xfb, 0x6b, 0x6c, 0x1a, 0x19, 0xbd, 0x82, 0x25, 0x63, 0x2f, 0x16, 0x6c, 0xc0, 0x03, 0x2a,
-	0xbc, 0x5b, 0x1b, 0x73, 0x5b, 0xf9, 0x9d, 0x87, 0x53, 0xb5, 0x18, 0x0d, 0x47, 0x9a, 0xd3, 0x2f,
-	0x04, 0x13, 0x5f, 0x02, 0x55, 0xc1, 0xb5, 0x8b, 0x40, 0x06, 0x92, 0xe1, 0x9e, 0x8c, 0x85, 0xf7,
-	0x17, 0xda, 0xe2, 0xe2, 0xa5, 0x52, 0xb0, 0xcb, 0x58, 0xfc, 0x86, 0xc4, 0x03, 0xea, 0xdb, 0xb0,
-	0x2c, 0x0f, 0x24, 0x7b, 0x2d, 0x63, 0x81, 0x1e, 0xc2, 0xa2, 0xe4, 0x03, 0x21, 0x71, 0xc8, 0x7a,
-	0x24, 0x4a, 0xbc, 0xa2, 0x0e, 0xaa, 0xbc, 0xa6, 0x55, 0x35, 0x09, 0x7d, 0x06, 0x37, 0x27, 0x59,
-	0x30, 0x89, 0x23, 0x22, 0xa8, 0xf0, 0x4a, 0x1b, 0x73, 0x5b, 0x0b, 0x3e, 0x9a, 0x60, 0x2d, 0x9b,
-	0x11, 0xf4, 0x35, 0x2c, 0x07, 0x04, 0x07, 0x94, 0xcb, 0xa8, 0x1d, 0x05, 0x44, 0x52, 0xe1, 0x7d,
-	0xa9, 0x67, 0xb9, 0x3d, 0xcb, 0x97, 0x95, 0xb1, 0x4c, 0x95, 0x48, 0xe2, 0x2f, 0x05, 0x64, 0x82,
-	0x24, 0xd0, 0xaf, 0x61, 0x3d, 0x5d, 0x76, 0x1b, 0x69, 0x98, 0x9e, 0xa9, 0xe2, 0x8b, 0x25, 0xf3,
-	0x1e, 0x68, 0x83, 0x6e, 0x59, 0x06, 0x1b, 0x66, 0x35, 0x3d, 0xdc, 0x64, 0xe8, 0x15, 0x3c, 0x4c,
-	0x45, 0x4f, 0x23, 0x2e, 0x07, 0x24, 0x9e, 0x02, 0xb1, 0xa1, 0x21, 0xee, 0x59, 0xc6, 0x37, 0x86,
-	0xef, 0x22, 0x52, 0x1d, 0x36, 0x53, 0xa4, 0x8b, 0xbb, 0xd1, 0x04, 0xd4, 0x43, 0x0d, 0x75, 0xdf,
-	0x72, 0x56, 0xc7, 0x8c, 0xfe, 0x20, 0x1e, 0x63, 0x3d, 0x82, 0x25, 0xce, 0x98, 0xc4, 0x09, 0xe9,
-	0x51, 0xd1, 0x27, 0x01, 0xf5, 0x36, 0x4d, 0x01, 0x50, 0xd4, 0xfd, 0x94, 0x88, 0xda, 0xb0, 0x1a,
-	0xb3, 0x80, 0xc4, 0x91, 0x1c, 0xe2, 0xb8, 0x85, 0x85, 0x29, 0xb5, 0xde, 0x47, 0x7a, 0xbd, 0xbf,
-	0x78, 0x4f, 0xb9, 0x6e, 0x58, 0xa9, 0x06, 0x23, 0xe1, 0x2e, 0x89, 0x49, 0x12, 0x50, 0x6e, 0x0b,
-	0xb5, 0xbf, 0x92, 0x42, 0x36, 0x5a, 0x96, 0x84, 0x2a, 0xe0, 0x86, 0x89, 0xc0, 0x9c, 0xb6, 0x39,
-	0x15, 0x5d, 0xac, 0xf6, 0x4a, 0xef, 0xe3, 0x99, 0xdb, 0x55, 0x98, 0x08, 0xdf, 0x48, 0xf8, 0x44,
-	0x52, 0xf4, 0x1d, 0xac, 0x74, 0x77, 0xf0, 0xa0, 0xdf, 0xe1, 0x24, 0xa4, 0x69, 0x32, 0xfd, 0x42,
-	0xd7, 0x9f, 0x99, 0x01, 0xf0, 0x6a, 0xe7, 0xd8, 0xc8, 0xd9, 0x34, 0x5a, 0xee, 0x9e, 0x27, 0xa8,
-	0x08, 0x88, 0x12, 0x93, 0xae, 0x41, 0x3c, 0x10, 0x92, 0x72, 0x2c, 0x24, 0x31, 0x0e, 0xf4, 0x3e,
-	0xd5, 0xbe, 0xbb, 0x65, 0x19, 0x2a, 0x66, 0xfc, 0x48, 0x12, 0xed, 0x49, 0x55, 0x70, 0x46, 0xa9,
-	0x7e, 0x59, 0xf6, 0x2f, 0xb5, 0xec, 0xa8, 0x18, 0x5c, 0x14, 0xae, 0xc2, 0xe2, 0xb9, 0x80, 0xde,
-	0xd6, 0x01, 0x3d, 0xbd, 0xdc, 0x4c, 0x84, 0xac, 0x7f, 0x4e, 0x0a, 0xfd, 0x1d, 0x14, 0x64, 0x97,
-	0x47, 0xed, 0x51, 0xd5, 0x7a, 0xaa, 0x9d, 0xfb, 0xe9, 0x2c, 0xb7, 0x34, 0xb5, 0x90, 0xad, 0x60,
-	0x8b, 0x72, 0xe2, 0x0b, 0x7d, 0x0b, 0x6e, 0x1a, 0xc7, 0x36, 0x2c, 0x84, 0xb7, 0xf3, 0x61, 0xd9,
-	0x66, 0x03, 0x3b, 0xdd, 0xb8, 0xfd, 0x65, 0x71, 0x9e, 0x80, 0x7c, 0xb8, 0x6d, 0x6b, 0x4c, 0x9f,
-	0xb3, 0x1e, 0x95, 0x5d, 0x3a, 0x10, 0xb8, 0x47, 0x79, 0x87, 0x7a, 0xcf, 0x66, 0x96, 0x9a, 0x35,
-	0x23, 0x7a, 0x38, 0x92, 0x7c, 0xad, 0x04, 0xd1, 0x77, 0x70, 0xf7, 0x94, 0xf2, 0xa8, 0x3d, 0x9c,
-	0x2c, 0x10, 0x98, 0x48, 0x1c, 0xc4, 0x11, 0x4d, 0xa4, 0xf7, 0xc5, 0x4c, 0xe0, 0x75, 0x23, 0x3f,
-	0xe1, 0xe5, 0xb2, 0xac, 0x68, 0x61, 0xb4, 0x03, 0xd9, 0x80, 0x78, 0xbf, 0xd2, 0x10, 0x9b, 0x33,
-	0x8b, 0x4d, 0xd9, 0xcf, 0x06, 0x04, 0xb5, 0x60, 0x95, 0x9e, 0x49, 0x9a, 0x08, 0x95, 0xc4, 0x7d,
-	0xce, 0x4e, 0xa3, 0x90, 0x72, 0xe1, 0xfd, 0x5a, 0xfb, 0x70, 0xe6, 0x86, 0x59, 0x4b, 0x45, 0x0f,
-	0xad, 0xa4, 0x8f, 0xe8, 0x45, 0x92, 0x40, 0xbf, 0x85, 0x95, 0xb4, 0x64, 0x8c, 0x35, 0xfc, 0x95,
-	0x36, 0xf3, 0xb3, 0x59, 0x1a, 0xaa, 0x46, 0x70, 0x04, 0xe6, 0xbb, 0xe1, 0x05, 0x0a, 0x0a, 0x61,
-	0x35, 0x8c, 0x44, 0xc0, 0x4e, 0x29, 0x1f, 0x8e, 0x7a, 0x13, 0xe1, 0xfd, 0x46, 0x4f, 0xe1, 0x59,
-	0xc9, 0xf4, 0xc6, 0xa5, 0xc9, 0xde, 0xb8, 0xd4, 0x3f, 0xe9, 0x28, 0x82, 0x28, 0xa9, 0xde, 0xb8,
-	0x74, 0xfa, 0xb4, 0xd4, 0x20, 0x2d, 0x1a, 0xa7, 0x0d, 0x8c, 0x8f, 0x46, 0x78, 0x29, 0x49, 0x14,
-	0xff, 0x35, 0x03, 0x6b, 0x53, 0x37, 0x3b, 0xb4, 0x0f, 0x39, 0xdd, 0x75, 0x65, 0x74, 0x92, 0x7f,
-	0xf9, 0x93, 0x76, 0xcc, 0x92, 0x6e, 0xbd, 0x34, 0xce, 0x66, 0x15, 0x72, 0xba, 0xe3, 0x5a, 0x81,
-	0x82, 0x5f, 0x7b, 0xb9, 0x77, 0xd4, 0xf4, 0xbf, 0xc1, 0x07, 0xfb, 0x8d, 0x6f, 0xdc, 0x6b, 0xa8,
-	0x00, 0x0b, 0xe5, 0x46, 0xe3, 0xe0, 0x2d, 0x2e, 0xef, 0x7f, 0xe3, 0x66, 0x36, 0x73, 0x4e, 0xd6,
-	0xcd, 0x3e, 0xb9, 0xf9, 0x66, 0xcf, 0x6f, 0x1e, 0x97, 0x1b, 0xf8, 0xa8, 0xe6, 0xbf, 0xd9, 0xab,
-	0xd4, 0x34, 0x73, 0xb1, 0x03, 0xcb, 0x17, 0xf6, 0x13, 0x84, 0x60, 0xae, 0x4f, 0x7b, 0xda, 0xce,
-	0x85, 0x57, 0xd7, 0x7c, 0xf5, 0x81, 0x3e, 0x85, 0x15, 0xd1, 0x8f, 0xda, 0x6d, 0x8a, 0x5b, 0x83,
-	0x24, 0x8c, 0x29, 0x1e, 0xf0, 0xd8, 0xcb, 0x5a, 0x8e, 0x65, 0x33, 0xb4, 0xab, 0x47, 0x8e, 0x79,
-	0xbc, 0x8b, 0xc0, 0x9d, 0x8c, 0xdb, 0x90, 0x48, 0x52, 0xfc, 0x3d, 0x2c, 0x4e, 0x26, 0x28, 0xfa,
-	0x18, 0x96, 0x54, 0xe5, 0xc4, 0x71, 0xd4, 0x8b, 0xa4, 0x86, 0xcb, 0x98, 0x36, 0x57, 0x51, 0x1b,
-	0x8a, 0x78, 0xcc, 0x63, 0xf4, 0x12, 0xd0, 0x04, 0x57, 0xda, 0xcd, 0x67, 0x67, 0x55, 0x5b, 0x77,
-	0x04, 0x62, 0xbb, 0xf8, 0xe2, 0xbf, 0x65, 0x60, 0xf9, 0x42, 0x2a, 0xa3, 0x26, 0x38, 0xa3, 0x6a,
-	0x90, 0xd1, 0x90, 0xcf, 0xaf, 0x58, 0x0d, 0x4a, 0xa3, 0xb2, 0x30, 0x42, 0x42, 0x37, 0xe1, 0x7a,
-	0x97, 0x09, 0x29, 0xbc, 0xac, 0xde, 0xdc, 0xcc, 0x47, 0x71, 0x1b, 0x9c, 0x91, 0xde, 0x8f, 0xa0,
-	0x90, 0x96, 0x56, 0xbd, 0xbb, 0x68, 0xe5, 0x8e, 0xbf, 0x68, 0x89, 0x7a, 0x3b, 0x2a, 0xfe, 0x31,
-	0x03, 0xd9, 0x4a, 0x19, 0x79, 0x30, 0x4f, 0xc2, 0x50, 0xf5, 0xcd, 0xd6, 0x3f, 0xe9, 0x27, 0x3a,
-	0x80, 0x45, 0x19, 0x8b, 0x71, 0x3d, 0xcb, 0x9e, 0xab, 0x92, 0x53, 0x8f, 0x25, 0x3a, 0xff, 0x9b,
-	0x8d, 0xa3, 0x91, 0xd5, 0x79, 0x19, 0x8b, 0x91, 0x59, 0xbb, 0xb0, 0xcc, 0xe9, 0xdf, 0x0f, 0xa8,
-	0x18, 0x3b, 0x7a, 0x6e, 0xe6, 0xb6, 0x66, 0x25, 0xd2, 0xc3, 0xd2, 0x03, 0xc8, 0x6b, 0xfd, 0x21,
-	0x16, 0x51, 0x48, 0xf5, 0xb9, 0xd0, 0xf1, 0xc1, 0x90, 0x8e, 0xa2, 0x90, 0x16, 0xff, 0xe3, 0x2e,
-	0xac, 0x5c, 0x2a, 0x07, 0x08, 0x41, 0x4e, 0xef, 0x2f, 0x66, 0x8a, 0xfa, 0x37, 0xfa, 0x87, 0x0c,
-	0xdc, 0x34, 0x3d, 0x2f, 0x3d, 0x93, 0xaa, 0x7f, 0xeb, 0x7e, 0xaf, 0xcf, 0x91, 0x76, 0xa2, 0x5f,
-	0x5f, 0xb9, 0xe8, 0x94, 0x74, 0x83, 0xac, 0xc8, 0x3c, 0x21, 0x71, 0x79, 0x20, 0xbb, 0x8c, 0x47,
-	0xdf, 0xeb, 0x79, 0xe8, 0x93, 0xa8, 0x65, 0x7b, 0x75, 0xcd, 0x5f, 0xa1, 0x96, 0x53, 0x31, 0x7d,
-	0xaf, 0x06, 0xa7, 0x5a, 0xd3, 0xe1, 0xfd, 0xc0, 0xba, 0xe8, 0x67, 0xb5, 0xe6, 0x25, 0xef, 0x07,
-	0x3f, 0x6a, 0x8d, 0x1a, 0x44, 0x04, 0x6e, 0x7c, 0x1f, 0xf5, 0x4f, 0xa2, 0x44, 0x7b, 0x38, 0xbf,
-	0xf3, 0xf2, 0xea, 0xea, 0xbf, 0xd5, 0xf2, 0xf6, 0x90, 0x35, 0xa1, 0xcd, 0x02, 0xa3, 0xdf, 0xc1,
-	0x42, 0x1c, 0x75, 0xba, 0x52, 0x48, 0xda, 0xd7, 0xa7, 0xf6, 0xf1, 0x91, 0xf7, 0x0a, 0x5a, 0x1a,
-	0x29, 0xc4, 0x65, 0x45, 0x63, 0x78, 0x14, 0xc2, 0xbc, 0xaa, 0x11, 0x21, 0xeb, 0xd8, 0x73, 0xff,
-	0xab, 0xab, 0x6b, 0xaa, 0x1a, 0x80, 0xcb, 0x7a, 0x52, 0x68, 0x14, 0x41, 0x5e, 0x48, 0x12, 0x9c,
-	0x84, 0x3c, 0x3a, 0xa5, 0x5c, 0x9f, 0xaa, 0xf3, 0x3b, 0xb5, 0xab, 0x6b, 0x3a, 0x1a, 0x83, 0x4c,
-	0xa8, 0x99, 0xc4, 0x46, 0x1c, 0x80, 0xf5, 0x69, 0x12, 0xd0, 0x44, 0x0c, 0x84, 0x3e, 0x98, 0xe7,
-	0x77, 0x0e, 0xaf, 0xae, 0xe9, 0xa0, 0x4f, 0x93, 0x8a, 0xc6, 0x28, 0x77, 0x54, 0xe6, 0x5e, 0x9a,
-	0xdb, 0x84, 0x16, 0xd4, 0x03, 0x10, 0x27, 0xc3, 0x77, 0x24, 0x56, 0x49, 0xaf, 0xcf, 0xf6, 0xf9,
-	0x9d, 0xaf, 0x7e, 0xc2, 0xec, 0x4e, 0x86, 0x6f, 0x0d, 0xc6, 0x14, 0x75, 0x63, 0x05, 0xc5, 0x7f,
-	0xc9, 0xc0, 0xa3, 0x1f, 0x0f, 0x61, 0xdf, 0x94, 0x85, 0x5d, 0x16, 0x0e, 0xd5, 0xc1, 0xbc, 0x47,
-	0xce, 0x70, 0x5a, 0x5b, 0x5a, 0x43, 0xd5, 0x1a, 0xaa, 0x4c, 0x2f, 0xf8, 0xcb, 0x3d, 0x72, 0x96,
-	0xb2, 0x2a, 0x32, 0xda, 0x81, 0x35, 0x12, 0xc7, 0xec, 0x1d, 0xee, 0x13, 0x2e, 0x23, 0x12, 0xe3,
-	0x1e, 0x15, 0x82, 0x74, 0xa8, 0x4e, 0x7a, 0xc7, 0x5f, 0xd5, 0x83, 0x87, 0x66, 0xec, 0xb5, 0x19,
-	0x42, 0x9b, 0x50, 0xe8, 0x93, 0xe0, 0x04, 0x13, 0x61, 0xb1, 0xe7, 0x34, 0x6f, 0x5e, 0x11, 0xcb,
-	0x42, 0xe3, 0x16, 0xff, 0x7d, 0x1e, 0x1e, 0x7f, 0x58, 0xfa, 0xab, 0x8a, 0x9b, 0x1e, 0xd0, 0x6d,
-	0xc5, 0xb5, 0x9f, 0xaa, 0x4a, 0xe9, 0x3b, 0xac, 0xac, 0xb6, 0x5d, 0xff, 0x46, 0xcf, 0x60, 0x3e,
-	0x2d, 0x96, 0x0b, 0xb3, 0x8a, 0x65, 0xca, 0xa9, 0xaa, 0x64, 0x9f, 0xc8, 0x2e, 0xee, 0x73, 0xda,
-	0x8e, 0xce, 0xb4, 0xbd, 0x0b, 0x3e, 0x28, 0xd2, 0xa1, 0xa6, 0xa0, 0x3b, 0xb0, 0xd0, 0x26, 0x51,
-	0x8c, 0xd5, 0xf2, 0xda, 0x22, 0xea, 0x28, 0x82, 0x0a, 0x08, 0xf4, 0x18, 0x96, 0x55, 0x47, 0x3e,
-	0x10, 0x98, 0x25, 0x98, 0x72, 0xce, 0xb8, 0xce, 0xcf, 0x05, 0xbf, 0x60, 0xc8, 0x07, 0x49, 0x4d,
-	0x11, 0xd1, 0xaf, 0xc0, 0x8b, 0x92, 0x20, 0x1e, 0x84, 0x14, 0x77, 0x29, 0x51, 0x3d, 0x10, 0x8e,
-	0x12, 0x1c, 0x74, 0x69, 0x70, 0xe2, 0xdd, 0xd0, 0x7b, 0xd3, 0x9a, 0x1d, 0x7f, 0x65, 0x86, 0xf7,
-	0x92, 0x8a, 0x1a, 0x44, 0x2f, 0x60, 0x23, 0x15, 0x4c, 0x17, 0xed, 0x12, 0x00, 0x68, 0x80, 0xbb,
-	0x96, 0xcf, 0xae, 0xe1, 0x05, 0x9c, 0x3f, 0x64, 0xe0, 0xa3, 0x14, 0x88, 0x84, 0x61, 0xa4, 0x9c,
-	0x40, 0xe2, 0xcb, 0x58, 0x79, 0xdd, 0x82, 0xfd, 0xfe, 0x4f, 0x55, 0xd0, 0x4b, 0x7b, 0xc6, 0x86,
-	0xf2, 0xc8, 0x84, 0xf3, 0x76, 0xd6, 0x12, 0xc9, 0x87, 0xfe, 0x83, 0xe8, 0xfd, 0x5c, 0xe8, 0x9f,
-	0x33, 0x70, 0xef, 0xa2, 0x5b, 0x5a, 0x2c, 0x1c, 0x8e, 0xe7, 0xb1, 0xa8, 0x03, 0xe0, 0xed, 0xcf,
-	0x39, 0x8f, 0x89, 0x3c, 0xf2, 0xd7, 0xcf, 0x3b, 0x5b, 0xd1, 0x52, 0xdb, 0xfe, 0x1a, 0xee, 0xa6,
-	0x5e, 0x95, 0x0c, 0x0f, 0xfa, 0x42, 0x72, 0x4a, 0x7a, 0x2a, 0x3e, 0x74, 0xc2, 0x78, 0xf3, 0x7a,
-	0xb5, 0x3c, 0xcb, 0xd3, 0x64, 0xc7, 0x96, 0xe3, 0x20, 0x29, 0xab, 0x71, 0xf4, 0xb7, 0x70, 0x6f,
-	0x42, 0x3e, 0x64, 0xef, 0x92, 0x31, 0x42, 0x48, 0x93, 0xa1, 0xe7, 0x68, 0x80, 0xf5, 0x11, 0x40,
-	0x75, 0xc4, 0x72, 0x90, 0x54, 0x69, 0x32, 0x2c, 0xfa, 0xf0, 0xf1, 0x87, 0xb8, 0x19, 0xb9, 0x30,
-	0x77, 0x42, 0x87, 0x36, 0xb3, 0xd4, 0x4f, 0xd5, 0x2f, 0x9d, 0xaa, 0x23, 0x8b, 0x69, 0x27, 0x7d,
-	0xf3, 0xf1, 0x65, 0xf6, 0x79, 0xa6, 0xf8, 0xbf, 0xd9, 0xf7, 0x25, 0xed, 0xe4, 0x2e, 0xf9, 0xd3,
-	0x93, 0xf6, 0xfa, 0x07, 0x27, 0xed, 0xb9, 0x9c, 0x9c, 0x9b, 0x9d, 0x93, 0xb9, 0x69, 0x39, 0x39,
-	0x3b, 0x88, 0x6e, 0xfc, 0xb9, 0x82, 0xa8, 0x78, 0x02, 0x6b, 0x53, 0x9b, 0x82, 0x2b, 0x3a, 0xf7,
-	0x63, 0x58, 0x52, 0xe5, 0x5e, 0x92, 0x0e, 0x8e, 0x69, 0xd2, 0x91, 0x5d, 0xed, 0xac, 0x82, 0xbf,
-	0xd8, 0x23, 0x67, 0x4d, 0xd2, 0x69, 0x68, 0x5a, 0xf1, 0x1f, 0x33, 0xe0, 0xfd, 0x58, 0x73, 0x70,
-	0x45, 0x85, 0x0f, 0x61, 0xd1, 0x5e, 0xae, 0x4a, 0x76, 0x62, 0xd7, 0x66, 0xc1, 0xcf, 0x1b, 0x5a,
-	0x53, 0x91, 0xa6, 0xd8, 0x94, 0x9b, 0x62, 0x53, 0x0c, 0xb7, 0xa6, 0x77, 0x11, 0x7f, 0x12, 0x0f,
-	0xc4, 0xb0, 0xfe, 0xa3, 0x7b, 0xed, 0xcf, 0xee, 0x81, 0xe2, 0x7f, 0x67, 0x61, 0x75, 0x4a, 0xe3,
-	0xa2, 0xb2, 0x2f, 0xa4, 0xad, 0x41, 0xc7, 0x9e, 0x41, 0xcc, 0x07, 0x6a, 0x82, 0xa7, 0x66, 0x90,
-	0x0c, 0x7a, 0x2d, 0xca, 0x31, 0x6b, 0x63, 0x22, 0x25, 0x8f, 0x5a, 0x03, 0xb5, 0xbb, 0x9a, 0xf6,
-	0xfb, 0xce, 0xa5, 0x8c, 0xd9, 0x4b, 0xe4, 0x17, 0x9f, 0xdb, 0x5b, 0x8d, 0x1e, 0x39, 0xdb, 0xd7,
-	0xb2, 0x07, 0xed, 0xf2, 0x48, 0x12, 0xbd, 0x81, 0xf5, 0x0b, 0xa8, 0x49, 0xc2, 0xa4, 0x0e, 0x51,
-	0x61, 0xfb, 0xe8, 0xf7, 0xc2, 0xde, 0x9a, 0x84, 0x1d, 0x8b, 0xa2, 0xef, 0xe0, 0xee, 0x79, 0x5c,
-	0xdb, 0x34, 0x60, 0x7a, 0x4a, 0x13, 0x29, 0x6c, 0x8f, 0xfc, 0x5e, 0x68, 0x6f, 0x02, 0xda, 0xf6,
-	0x15, 0x35, 0x2d, 0x3c, 0x65, 0x31, 0xaf, 0x4f, 0x59, 0xcc, 0x3f, 0x66, 0xe1, 0xfe, 0xfb, 0xbb,
-	0xb5, 0x2b, 0x2e, 0xe9, 0x3b, 0x98, 0x0f, 0x58, 0x22, 0xe9, 0x99, 0x3a, 0x84, 0xcd, 0x6d, 0x2d,
-	0xed, 0xfc, 0xf6, 0xe7, 0x6e, 0x1f, 0x4b, 0xea, 0x9b, 0x56, 0x8c, 0x12, 0x3f, 0xd5, 0xf6, 0x61,
-	0xa9, 0xb2, 0x49, 0x61, 0x71, 0x52, 0x1c, 0x2d, 0x43, 0xfe, 0x78, 0xff, 0xe8, 0xb0, 0x56, 0xd9,
-	0x7b, 0xb1, 0x57, 0xab, 0xba, 0xd7, 0xd0, 0x1a, 0xac, 0xbc, 0x7d, 0x56, 0xc1, 0x4d, 0xbf, 0x5c,
-	0xa9, 0xe1, 0xca, 0xc1, 0x7e, 0xb3, 0xf6, 0x75, 0xd3, 0xcd, 0xa0, 0x45, 0x70, 0x5e, 0xfa, 0x87,
-	0x15, 0xbc, 0xbb, 0xb7, 0xef, 0x66, 0xd1, 0x6d, 0x58, 0xad, 0x34, 0x0e, 0x8e, 0xab, 0x17, 0xd8,
-	0xe6, 0xd0, 0x0d, 0xc8, 0xee, 0x3e, 0x73, 0x73, 0xbb, 0x00, 0x4e, 0x7a, 0x15, 0x54, 0xfc, 0x14,
-	0xdc, 0x8b, 0xb7, 0x3c, 0xca, 0xa7, 0xe9, 0xdb, 0x91, 0xf5, 0xa9, 0xfd, 0xdc, 0xac, 0xc3, 0xda,
-	0xd4, 0x77, 0xab, 0xcb, 0x96, 0xce, 0xc3, 0xdc, 0xc1, 0x8b, 0x17, 0x6e, 0x06, 0xe5, 0x61, 0xbe,
-	0x5a, 0x7b, 0x51, 0x3e, 0x6e, 0x34, 0xdd, 0x2c, 0x02, 0xb8, 0x71, 0xd4, 0xf4, 0xf7, 0x2a, 0x4d,
-	0x77, 0x6e, 0xf3, 0x31, 0x80, 0xaa, 0xa7, 0xf6, 0x1e, 0xc7, 0x81, 0xdc, 0xfe, 0xc1, 0x7e, 0xcd,
-	0xbd, 0x86, 0x96, 0x00, 0x5e, 0x1f, 0xeb, 0x2b, 0x95, 0x66, 0xe3, 0xc8, 0xcd, 0x6c, 0x7e, 0x02,
-	0x2b, 0x97, 0x9e, 0x86, 0x14, 0xbb, 0x9e, 0xd4, 0x35, 0xf5, 0xab, 0x7e, 0x74, 0xb0, 0xef, 0x66,
-	0x36, 0x77, 0x60, 0xf9, 0xc2, 0x1d, 0x2e, 0x42, 0xb0, 0x54, 0x3d, 0xc0, 0xfb, 0x07, 0x4d, 0x7c,
-	0x7c, 0xf8, 0xd2, 0x2f, 0x57, 0x15, 0x7e, 0x1e, 0xe6, 0xd3, 0x8f, 0x4c, 0x3d, 0xe7, 0x64, 0xdc,
-	0x6c, 0x3d, 0xe7, 0x64, 0xdd, 0xb9, 0x7a, 0xce, 0x99, 0x73, 0x73, 0xf5, 0x9c, 0xf3, 0x99, 0xfb,
-	0xb4, 0x9e, 0x73, 0xd6, 0xdd, 0x62, 0x3d, 0xe7, 0xdc, 0x77, 0x1f, 0xd4, 0x73, 0x0e, 0xb8, 0xf9,
-	0x7a, 0xce, 0xc9, 0xbb, 0x8b, 0xf5, 0x9c, 0xb3, 0xec, 0xba, 0xf5, 0x9c, 0xe3, 0xba, 0x2b, 0xf5,
-	0x9c, 0x83, 0xdc, 0xd5, 0x7a, 0xce, 0x59, 0x75, 0x6f, 0xd6, 0x73, 0xce, 0x4d, 0x77, 0xad, 0x9e,
-	0x73, 0xd6, 0xdc, 0x5b, 0xf5, 0x9c, 0x73, 0xdb, 0xf5, 0xea, 0x39, 0xe7, 0x9e, 0x7b, 0xbf, 0x9e,
-	0x73, 0x7e, 0xe9, 0x7e, 0x51, 0xcf, 0x39, 0x8f, 0xdc, 0xc7, 0xf5, 0x9c, 0xf3, 0xd8, 0xfd, 0xa4,
-	0x9e, 0x73, 0x3e, 0x71, 0xb7, 0x7c, 0xd4, 0x8b, 0xce, 0x28, 0x37, 0x9b, 0x93, 0x7e, 0x0c, 0xa0,
-	0xdc, 0x5f, 0x35, 0x34, 0x4e, 0xf5, 0x3d, 0xbe, 0x25, 0xae, 0xa5, 0x0f, 0x55, 0xe6, 0x32, 0xdb,
-	0x48, 0x08, 0x7f, 0xf4, 0x7e, 0x65, 0x64, 0xf4, 0x4b, 0xb0, 0x11, 0x14, 0xfe, 0xad, 0x49, 0x56,
-	0x3c, 0xda, 0x5d, 0xfd, 0x47, 0x22, 0x0a, 0x69, 0x40, 0xb8, 0x6a, 0x46, 0x24, 0x8d, 0x69, 0x8f,
-	0x4a, 0x7d, 0x67, 0x27, 0xf4, 0xf5, 0x23, 0x69, 0xb7, 0xa3, 0x24, 0x92, 0x43, 0x3f, 0xaf, 0x8e,
-	0xe1, 0x56, 0x9d, 0xbf, 0xc2, 0xc3, 0xf1, 0x9d, 0x7c, 0x48, 0x63, 0x32, 0xf4, 0x0b, 0x46, 0xa5,
-	0xbd, 0x30, 0xf1, 0xd3, 0xf7, 0x38, 0x73, 0x87, 0xaa, 0x2f, 0x28, 0xce, 0xd9, 0xea, 0x2f, 0x8a,
-	0x50, 0xe0, 0x41, 0x28, 0xb0, 0xea, 0xc4, 0xfd, 0x15, 0x71, 0x09, 0xf0, 0x96, 0x45, 0x50, 0x23,
-	0xba, 0xd2, 0xe2, 0x1e, 0x1b, 0x24, 0xd2, 0x47, 0x5a, 0x50, 0x50, 0x7c, 0xf2, 0x5c, 0x60, 0x41,
-	0xf0, 0xef, 0xde, 0x49, 0xbf, 0x28, 0x29, 0xef, 0xa5, 0xcf, 0x1e, 0x21, 0x27, 0x51, 0x82, 0xd3,
-	0x57, 0x7f, 0xff, 0x66, 0xea, 0x13, 0xeb, 0xc1, 0x16, 0x91, 0x41, 0xd7, 0xf7, 0x26, 0xbf, 0xb0,
-	0x4a, 0x42, 0x9a, 0x48, 0x1e, 0x51, 0xe1, 0xaf, 0x5d, 0x1a, 0x51, 0x4d, 0xc9, 0xe6, 0x1f, 0x32,
-	0xb0, 0x38, 0xf9, 0xfa, 0xf5, 0xff, 0x79, 0x59, 0x74, 0x08, 0x37, 0xc5, 0xa0, 0x25, 0x02, 0x1e,
-	0xb5, 0x68, 0x88, 0x39, 0x4d, 0x5f, 0xea, 0x4c, 0xb1, 0xba, 0x37, 0xb5, 0x58, 0xf9, 0x96, 0xcb,
-	0x5f, 0x1d, 0x8b, 0xa6, 0x34, 0xb1, 0xf9, 0x15, 0xe4, 0x27, 0x6e, 0x22, 0xd5, 0x19, 0x49, 0xd0,
-	0x80, 0x53, 0xfb, 0xf2, 0x60, 0xe6, 0x03, 0x86, 0xa4, 0x1f, 0x1b, 0xee, 0xc0, 0x42, 0x98, 0x08,
-	0xf3, 0x28, 0x64, 0xef, 0xda, 0x9c, 0x30, 0x11, 0xfa, 0x3d, 0xe8, 0xc9, 0x06, 0x38, 0x29, 0x32,
-	0xba, 0x09, 0x6e, 0x7a, 0xe5, 0x99, 0x5e, 0x94, 0xba, 0xd7, 0x76, 0xb7, 0xfe, 0xf3, 0x87, 0xfb,
-	0x99, 0xff, 0xfa, 0xe1, 0x7e, 0xe6, 0x7f, 0x7e, 0xb8, 0x9f, 0xf9, 0xb6, 0x68, 0xec, 0x35, 0x7f,
-	0x8e, 0xd8, 0x3e, 0xf7, 0x77, 0x8b, 0xd6, 0x0d, 0xbd, 0x61, 0x3c, 0xfb, 0xbf, 0x00, 0x00, 0x00,
-	0xff, 0xff, 0x43, 0x59, 0xfd, 0x95, 0xf7, 0x21, 0x00, 0x00,
+	0x72, 0x16, 0x40, 0x48, 0x6c, 0x26, 0x00, 0xb2, 0x59, 0x24, 0xa5, 0x26, 0xf4, 0x47, 0x71, 0x46,
+	0x1a, 0xae, 0x3c, 0x06, 0x47, 0xd4, 0xec, 0xac, 0x76, 0xd6, 0x61, 0x1b, 0x04, 0x20, 0x91, 0x18,
+	0x88, 0xa4, 0x9b, 0xa0, 0x34, 0x3f, 0xb1, 0x51, 0x51, 0xe8, 0x2e, 0x00, 0xbd, 0x6c, 0x74, 0xc3,
+	0x55, 0x05, 0x8a, 0x98, 0x88, 0x7d, 0x02, 0xfb, 0xe2, 0xa3, 0x9f, 0xc1, 0x61, 0x1f, 0x7c, 0xf1,
+	0xc9, 0x77, 0x47, 0xec, 0xc5, 0x87, 0x3d, 0xfa, 0xe0, 0x98, 0xb3, 0x1f, 0xc2, 0x51, 0x3f, 0x0d,
+	0x34, 0x49, 0x8c, 0x20, 0x4e, 0xcc, 0xda, 0x37, 0x74, 0x56, 0xe6, 0x97, 0x59, 0x59, 0x99, 0x59,
+	0x59, 0x55, 0x80, 0x52, 0x9f, 0xf2, 0xde, 0xf6, 0xd9, 0x33, 0x12, 0x0e, 0x7a, 0xe4, 0xd9, 0xb6,
+	0x17, 0x47, 0x9d, 0xa0, 0x5b, 0x1e, 0xb0, 0x58, 0xc4, 0x68, 0x25, 0xe0, 0x22, 0x88, 0xcb, 0x92,
+	0xa3, 0x9c, 0x70, 0x94, 0x1e, 0x74, 0xe3, 0xb8, 0x1b, 0xd2, 0x6d, 0xc5, 0xd2, 0x1e, 0x76, 0xb6,
+	0xfd, 0x21, 0x23, 0x22, 0x88, 0x23, 0x2d, 0x74, 0x75, 0xfc, 0x1d, 0x23, 0x83, 0x01, 0x65, 0xdc,
+	0x8c, 0xaf, 0x5f, 0x54, 0x38, 0x60, 0xf1, 0xf9, 0xc8, 0x0c, 0x3d, 0x8d, 0xa8, 0x78, 0x17, 0xb3,
+	0xd3, 0x20, 0xea, 0x26, 0x0c, 0xcf, 0xb7, 0x7d, 0xca, 0x45, 0x10, 0x29, 0x0d, 0x98, 0x0d, 0x43,
+	0x6a, 0x78, 0x3f, 0x3f, 0x7d, 0xc1, 0xcb, 0x41, 0xbc, 0x4d, 0x06, 0x41, 0x9f, 0x78, 0xbd, 0x20,
+	0xa2, 0x6c, 0xb4, 0x3d, 0x38, 0xed, 0x4a, 0x02, 0xdf, 0xee, 0x53, 0x41, 0xb6, 0xcf, 0x9e, 0x6d,
+	0x77, 0x69, 0x44, 0x19, 0x11, 0xd4, 0xd7, 0x52, 0x9b, 0xff, 0xfe, 0x57, 0x00, 0xaf, 0x29, 0xef,
+	0x55, 0xd5, 0x34, 0xd1, 0x53, 0x58, 0x56, 0xfa, 0x71, 0x18, 0x70, 0x41, 0x23, 0x3c, 0x88, 0x99,
+	0x70, 0x72, 0x1b, 0x99, 0xad, 0x9b, 0xee, 0x92, 0x1a, 0x68, 0x2a, 0xfa, 0x51, 0xcc, 0x04, 0x7a,
+	0x02, 0x9a, 0x84, 0x7b, 0x42, 0x0c, 0x34, 0xe7, 0x4d, 0xc5, 0x59, 0x54, 0xe4, 0x3d, 0x21, 0x06,
+	0x8a, 0x6f, 0x17, 0x96, 0xbc, 0x38, 0x8a, 0xa8, 0x27, 0xb0, 0x08, 0xfa, 0x34, 0x1e, 0x0a, 0xe7,
+	0xd6, 0x46, 0x66, 0x2b, 0xbf, 0xb3, 0x5e, 0xd6, 0x9e, 0x29, 0x27, 0x9e, 0x29, 0xd7, 0x8c, 0xe7,
+	0xdc, 0x45, 0x23, 0xd1, 0xd2, 0x02, 0xe8, 0x2d, 0x94, 0x14, 0x93, 0x17, 0x87, 0xd8, 0xa7, 0x82,
+	0x7a, 0x6a, 0xf6, 0x09, 0xdc, 0xd3, 0x59, 0x70, 0x4e, 0x22, 0x5c, 0x4b, 0x64, 0x13, 0xe0, 0x18,
+	0x8a, 0xc2, 0x1b, 0xe0, 0x53, 0x4a, 0x07, 0x24, 0x0c, 0xce, 0xa8, 0x73, 0x4f, 0x61, 0x35, 0xca,
+	0x7a, 0xa5, 0x27, 0xfe, 0x4f, 0xd6, 0xfb, 0x79, 0xb9, 0xaa, 0x4d, 0x0b, 0xe2, 0xe8, 0x28, 0x8e,
+	0xc3, 0x63, 0x2a, 0x44, 0x10, 0x75, 0x79, 0xb9, 0x55, 0x3d, 0x9a, 0xfc, 0xf6, 0x06, 0x5f, 0x25,
+	0x88, 0x6e, 0x41, 0xa4, 0xbe, 0xd0, 0x47, 0x50, 0x0c, 0xa2, 0x2e, 0xa3, 0x9c, 0x63, 0x2f, 0x24,
+	0x9c, 0x3b, 0xf3, 0x1b, 0x99, 0xad, 0x05, 0xb7, 0x60, 0x88, 0x55, 0x49, 0x43, 0x9f, 0xc0, 0x52,
+	0xc2, 0xc4, 0x29, 0x3b, 0x0b, 0x3c, 0xea, 0x58, 0x8a, 0x6d, 0xd1, 0x90, 0x8f, 0x35, 0x15, 0xf5,
+	0xe1, 0xce, 0x18, 0x2d, 0x8e, 0x04, 0x8b, 0xc3, 0x90, 0x32, 0xdc, 0x8f, 0x7d, 0xea, 0x2c, 0x6c,
+	0x64, 0xb6, 0x16, 0x77, 0x7e, 0x59, 0x9e, 0x12, 0xb2, 0xe5, 0xc9, 0x8a, 0x97, 0xf7, 0x8d, 0xde,
+	0xb1, 0xf4, 0xeb, 0xd8, 0xa7, 0xee, 0x5a, 0x30, 0x8d, 0x8c, 0x7e, 0x01, 0xf6, 0xc4, 0xae, 0x90,
+	0x7a, 0x22, 0x66, 0xce, 0xe7, 0xca, 0xb0, 0xa5, 0xb1, 0x61, 0x9a, 0x8c, 0x1e, 0xc3, 0x22, 0x8d,
+	0x48, 0x3b, 0xa4, 0x58, 0x30, 0xe2, 0x05, 0x51, 0xd7, 0x29, 0x6c, 0x64, 0xb6, 0x2c, 0xb7, 0xa8,
+	0xa9, 0x2d, 0x4d, 0x94, 0x41, 0x44, 0x3c, 0x4f, 0x02, 0x86, 0x71, 0x17, 0x77, 0x82, 0x90, 0x3a,
+	0x45, 0x05, 0x58, 0xd4, 0xe4, 0x66, 0xdc, 0x7d, 0x19, 0x84, 0x54, 0x06, 0x66, 0x9a, 0x2f, 0x66,
+	0x7d, 0x22, 0x1c, 0x47, 0xab, 0x9e, 0x70, 0x2a, 0x32, 0x22, 0xb0, 0x92, 0xe2, 0xa5, 0x91, 0x17,
+	0xfb, 0x52, 0xff, 0x5d, 0xe5, 0x90, 0x67, 0xb3, 0x1c, 0x52, 0x49, 0xd0, 0xea, 0x46, 0xd0, 0x5d,
+	0x26, 0x97, 0x49, 0xa8, 0x06, 0x0f, 0xcd, 0xec, 0x68, 0x74, 0x16, 0x8f, 0x70, 0x4a, 0x5f, 0xb2,
+	0x60, 0x5b, 0x6a, 0xba, 0x77, 0x35, 0x5b, 0x5d, 0x72, 0x8d, 0x91, 0x93, 0xd5, 0xfb, 0x0d, 0x94,
+	0xfc, 0x80, 0xa7, 0x60, 0x74, 0xd6, 0x51, 0x26, 0x81, 0x9c, 0x17, 0x0a, 0xe0, 0x8e, 0xe1, 0x50,
+	0x08, 0x4d, 0x33, 0xde, 0x8c, 0xbb, 0xe8, 0x15, 0x2c, 0xfa, 0xb4, 0x43, 0x86, 0xa1, 0xc0, 0xba,
+	0x46, 0x39, 0x8b, 0x2a, 0x74, 0x37, 0xa6, 0x4e, 0xf0, 0x48, 0xa6, 0xa4, 0x9e, 0xa1, 0x5b, 0x34,
+	0x72, 0x26, 0xe7, 0xfb, 0x70, 0x27, 0x1e, 0x8a, 0x76, 0x3c, 0x8c, 0x7c, 0xb9, 0x56, 0x9d, 0x4e,
+	0xe0, 0xe1, 0x41, 0x1c, 0x06, 0xde, 0xc8, 0x59, 0x56, 0x88, 0x33, 0x63, 0xe8, 0xd0, 0x88, 0xb7,
+	0xb4, 0xf4, 0x91, 0x12, 0x76, 0xd7, 0xe2, 0x69, 0x64, 0xb4, 0x07, 0x8b, 0xda, 0x5e, 0xcc, 0xe3,
+	0x21, 0xf3, 0x28, 0x77, 0x6e, 0x6f, 0xcc, 0x6d, 0xe5, 0x77, 0x1e, 0x4d, 0xd5, 0xa2, 0x35, 0x1c,
+	0x2b, 0x4e, 0xb7, 0xe8, 0xa5, 0xbe, 0x38, 0xaa, 0x81, 0x6d, 0x16, 0x81, 0x0c, 0x45, 0x8c, 0xfb,
+	0x22, 0xe4, 0xce, 0x9f, 0x29, 0x8b, 0x4b, 0x57, 0x4a, 0xc1, 0x6e, 0x1c, 0x87, 0x6f, 0x48, 0x38,
+	0xa4, 0xae, 0x09, 0xcb, 0xca, 0x50, 0xc4, 0xaf, 0x45, 0xc8, 0xd1, 0x23, 0x28, 0x08, 0x36, 0xe4,
+	0x02, 0xfb, 0x71, 0x9f, 0x04, 0x91, 0x53, 0x52, 0x41, 0x95, 0x57, 0xb4, 0x9a, 0x22, 0xa1, 0xcf,
+	0x60, 0x35, 0xcd, 0x82, 0x49, 0x18, 0x10, 0x4e, 0xb9, 0x53, 0xde, 0x98, 0xdb, 0x5a, 0x70, 0x51,
+	0x8a, 0xb5, 0xa2, 0x47, 0xd0, 0xd7, 0xb0, 0xe4, 0x11, 0xec, 0x51, 0x26, 0x82, 0x4e, 0xe0, 0x11,
+	0x41, 0xb9, 0xf3, 0xa5, 0x9a, 0xe5, 0xf6, 0x2c, 0x5f, 0x56, 0x27, 0x32, 0x35, 0x22, 0x88, 0xbb,
+	0xe8, 0x91, 0x14, 0x89, 0xa3, 0x5f, 0xc3, 0x7a, 0xb2, 0xec, 0x26, 0xd2, 0x30, 0x3d, 0x97, 0xc5,
+	0x17, 0x8b, 0xd8, 0x79, 0xa8, 0x0c, 0xba, 0x6d, 0x18, 0x4c, 0x98, 0xd5, 0xd5, 0x70, 0x2b, 0x46,
+	0x7b, 0xf0, 0x28, 0x11, 0x3d, 0x0b, 0x98, 0x18, 0x92, 0x70, 0x0a, 0xc4, 0x86, 0x82, 0xb8, 0x6f,
+	0x18, 0xdf, 0x68, 0xbe, 0xcb, 0x48, 0x0d, 0xd8, 0x4c, 0x90, 0x2e, 0xef, 0x46, 0x29, 0xa8, 0x47,
+	0x0a, 0xea, 0x81, 0xe1, 0xac, 0x4d, 0x18, 0xdd, 0x61, 0x38, 0xc1, 0x7a, 0x0c, 0x8b, 0x2c, 0x8e,
+	0x05, 0x8e, 0x48, 0x9f, 0xf2, 0x01, 0xf1, 0xa8, 0xb3, 0xa9, 0x0b, 0x80, 0xa4, 0x1e, 0x24, 0x44,
+	0xd4, 0x81, 0x95, 0x30, 0xf6, 0x48, 0x18, 0x88, 0x11, 0x0e, 0xdb, 0x98, 0xeb, 0x52, 0xeb, 0x7c,
+	0xa4, 0xd6, 0xfb, 0x8b, 0xf7, 0x94, 0xeb, 0xa6, 0x91, 0x6a, 0xc6, 0xc4, 0xdf, 0x25, 0x21, 0x89,
+	0x3c, 0xca, 0x4c, 0xa1, 0x76, 0x97, 0x13, 0xc8, 0x66, 0xdb, 0x90, 0x50, 0x15, 0x6c, 0x3f, 0xe2,
+	0x98, 0xd1, 0x0e, 0xa3, 0xbc, 0x87, 0xe5, 0x5e, 0xe9, 0x7c, 0x3c, 0x73, 0xbb, 0xf2, 0x23, 0xee,
+	0x6a, 0x09, 0x97, 0x08, 0x8a, 0xbe, 0x83, 0xe5, 0xde, 0x0e, 0x1e, 0x0e, 0xba, 0x8c, 0xf8, 0x34,
+	0x49, 0xa6, 0x5f, 0xa8, 0xfa, 0x33, 0x33, 0x00, 0xf6, 0x76, 0x4e, 0xb4, 0x9c, 0x49, 0xa3, 0xa5,
+	0xde, 0x45, 0x82, 0x8c, 0x80, 0x20, 0xd2, 0xe9, 0xea, 0x85, 0x43, 0x2e, 0x28, 0xc3, 0x5c, 0x10,
+	0xed, 0x40, 0xe7, 0x53, 0xe5, 0xbb, 0xdb, 0x86, 0xa1, 0xaa, 0xc7, 0x8f, 0x05, 0x51, 0x9e, 0x94,
+	0x05, 0x67, 0x9c, 0xea, 0x57, 0x65, 0xff, 0x5c, 0xc9, 0x8e, 0x8b, 0xc1, 0x65, 0xe1, 0x1a, 0x14,
+	0x2e, 0x04, 0xf4, 0xb6, 0x0a, 0xe8, 0xe9, 0xe5, 0x26, 0x15, 0xb2, 0xee, 0x05, 0x29, 0xf4, 0x37,
+	0x50, 0x14, 0x3d, 0x16, 0x74, 0xc6, 0x55, 0xeb, 0x99, 0x72, 0xee, 0xa7, 0xb3, 0xdc, 0xd2, 0x52,
+	0x42, 0xa6, 0x82, 0x15, 0x44, 0xea, 0x0b, 0x7d, 0x0b, 0x76, 0x12, 0xc7, 0x26, 0x2c, 0xb8, 0xb3,
+	0xf3, 0x61, 0xd9, 0x66, 0x02, 0x3b, 0xd9, 0xb8, 0xdd, 0x25, 0x7e, 0x91, 0x80, 0x5c, 0xb8, 0x63,
+	0x6a, 0xcc, 0x80, 0xc5, 0x7d, 0x2a, 0x7a, 0x74, 0xc8, 0x71, 0x9f, 0xb2, 0x2e, 0x75, 0x9e, 0xcf,
+	0x2c, 0x35, 0x6b, 0x5a, 0xf4, 0x68, 0x2c, 0xf9, 0x5a, 0x0a, 0xa2, 0xef, 0xe0, 0xde, 0x19, 0x65,
+	0x41, 0x67, 0x94, 0x2e, 0x10, 0x98, 0x08, 0xec, 0x85, 0x01, 0x8d, 0x84, 0xf3, 0xc5, 0x4c, 0xe0,
+	0x75, 0x2d, 0x9f, 0xf2, 0x72, 0x45, 0x54, 0x95, 0x30, 0xda, 0x81, 0xac, 0x47, 0x9c, 0x5f, 0x29,
+	0x88, 0xcd, 0x99, 0xc5, 0xa6, 0xe2, 0x66, 0x3d, 0x82, 0xda, 0xb0, 0x42, 0xcf, 0x05, 0x8d, 0xb8,
+	0x4c, 0xe2, 0x01, 0x8b, 0xcf, 0x02, 0x9f, 0x32, 0xee, 0xfc, 0x5a, 0xf9, 0x70, 0xe6, 0x86, 0x59,
+	0x4f, 0x44, 0x8f, 0x8c, 0xa4, 0x8b, 0xe8, 0x65, 0x12, 0x47, 0xbf, 0x85, 0xe5, 0xa4, 0x64, 0x4c,
+	0x34, 0xfc, 0x85, 0x32, 0xf3, 0xb3, 0x59, 0x1a, 0x6a, 0x5a, 0x70, 0x0c, 0xe6, 0xda, 0xfe, 0x25,
+	0x0a, 0xf2, 0x61, 0xc5, 0x0f, 0xb8, 0x17, 0x9f, 0x51, 0x36, 0x1a, 0xf7, 0x26, 0xdc, 0xf9, 0x8d,
+	0x9a, 0xc2, 0xf3, 0xb2, 0xee, 0x8d, 0xcb, 0xe9, 0xde, 0xb8, 0x3c, 0x38, 0xed, 0x4a, 0x02, 0x2f,
+	0xcb, 0xde, 0xb8, 0x7c, 0xf6, 0xac, 0xdc, 0x24, 0x6d, 0x1a, 0x26, 0x0d, 0x8c, 0x8b, 0xc6, 0x78,
+	0x09, 0x89, 0x97, 0xfe, 0x39, 0x03, 0x6b, 0x53, 0x37, 0x3b, 0x74, 0x00, 0x39, 0xd5, 0x75, 0x65,
+	0x54, 0x92, 0x7f, 0xf9, 0x93, 0x76, 0xcc, 0xb2, 0x6a, 0xbd, 0x14, 0xce, 0x66, 0x0d, 0x72, 0xaa,
+	0xe3, 0x5a, 0x86, 0xa2, 0x5b, 0x7f, 0xb5, 0x7f, 0xdc, 0x72, 0xbf, 0xc1, 0x87, 0x07, 0xcd, 0x6f,
+	0xec, 0x1b, 0xa8, 0x08, 0x0b, 0x95, 0x66, 0xf3, 0xf0, 0x2d, 0xae, 0x1c, 0x7c, 0x63, 0x67, 0x36,
+	0x73, 0x56, 0xd6, 0xce, 0x3e, 0x5d, 0x7d, 0xb3, 0xef, 0xb6, 0x4e, 0x2a, 0x4d, 0x7c, 0x5c, 0x77,
+	0xdf, 0xec, 0x57, 0xeb, 0x8a, 0xb9, 0xf4, 0xf7, 0x19, 0x58, 0xba, 0xb4, 0xa1, 0x20, 0x04, 0x73,
+	0x03, 0xda, 0x57, 0x86, 0x2e, 0xec, 0xdd, 0x70, 0xe5, 0x07, 0xfa, 0x14, 0x96, 0xf9, 0x20, 0xe8,
+	0x74, 0x28, 0x6e, 0x0f, 0x23, 0x3f, 0xa4, 0x78, 0xc8, 0x42, 0x27, 0x6b, 0x38, 0x96, 0xf4, 0xd0,
+	0xae, 0x1a, 0x39, 0x61, 0xa1, 0x6c, 0x61, 0xd3, 0xdb, 0x21, 0x77, 0xe6, 0x54, 0xa1, 0x2f, 0xa4,
+	0xf6, 0x41, 0xbe, 0x8b, 0xc0, 0x4e, 0x47, 0xb7, 0x4f, 0x04, 0x29, 0xfd, 0x1e, 0x0a, 0xe9, 0x34,
+	0x46, 0x1f, 0xc3, 0xa2, 0xac, 0xaf, 0x38, 0x0c, 0xfa, 0x81, 0x50, 0x3a, 0x33, 0xba, 0x19, 0x96,
+	0xd4, 0xa6, 0x24, 0x4a, 0x75, 0xaf, 0x00, 0xa5, 0xb8, 0x92, 0x9e, 0x3f, 0x3b, 0xab, 0x26, 0xdb,
+	0x63, 0x10, 0xd3, 0xeb, 0x97, 0xfe, 0x25, 0x03, 0x4b, 0x97, 0x12, 0x1e, 0xb5, 0xc0, 0x1a, 0xd7,
+	0x8c, 0x8c, 0x82, 0x7c, 0x71, 0xcd, 0x9a, 0x51, 0x1e, 0x17, 0x8f, 0x31, 0x12, 0x5a, 0x85, 0x9b,
+	0xbd, 0x98, 0x0b, 0xee, 0x64, 0x95, 0x67, 0xf4, 0x47, 0x69, 0x1b, 0xac, 0xb1, 0xde, 0x8f, 0xa0,
+	0x98, 0x14, 0x60, 0xb5, 0x07, 0x29, 0xe5, 0x96, 0x5b, 0x30, 0x44, 0xb5, 0x69, 0x95, 0xfe, 0x98,
+	0x81, 0x6c, 0xb5, 0x82, 0x1c, 0x98, 0x27, 0xbe, 0x2f, 0xbb, 0x6b, 0xe3, 0x9f, 0xe4, 0x13, 0x1d,
+	0x42, 0x41, 0x84, 0x7c, 0x52, 0xf5, 0xb2, 0x17, 0x6a, 0xe9, 0xd4, 0xc3, 0x8b, 0xaa, 0x12, 0xad,
+	0xe6, 0xf1, 0xd8, 0xea, 0xbc, 0x08, 0xf9, 0xd8, 0xac, 0x5d, 0x58, 0x62, 0xf4, 0x6f, 0x87, 0x94,
+	0x4f, 0x1c, 0x3d, 0x37, 0x73, 0xf3, 0x33, 0x12, 0xc9, 0x91, 0xea, 0x21, 0xe4, 0x95, 0x7e, 0x1f,
+	0xf3, 0xc0, 0xa7, 0xea, 0xf4, 0x68, 0xb9, 0xa0, 0x49, 0xc7, 0x81, 0x4f, 0x4b, 0xff, 0x76, 0x0f,
+	0x96, 0xaf, 0x14, 0x0d, 0x84, 0x20, 0xa7, 0x76, 0x21, 0x3d, 0x45, 0xf5, 0x1b, 0xfd, 0x5d, 0x06,
+	0x56, 0x75, 0x67, 0x4c, 0xcf, 0x85, 0xec, 0xf2, 0x7a, 0xdf, 0xab, 0xd3, 0xa6, 0x99, 0xe8, 0xd7,
+	0xd7, 0x2e, 0x4d, 0x65, 0xd5, 0x46, 0x4b, 0x32, 0x8b, 0x48, 0x58, 0x19, 0x8a, 0x5e, 0xcc, 0x82,
+	0xef, 0xd5, 0x3c, 0xd4, 0x79, 0xd5, 0xb0, 0xed, 0xdd, 0x70, 0x97, 0xa9, 0xe1, 0x94, 0x4c, 0xdf,
+	0xcb, 0xc1, 0xa9, 0xd6, 0x74, 0xd9, 0xc0, 0x33, 0x2e, 0xfa, 0x59, 0xad, 0x79, 0xc5, 0x06, 0xde,
+	0x8f, 0x5a, 0x23, 0x07, 0x11, 0x81, 0x5b, 0xdf, 0x07, 0x83, 0xd3, 0x20, 0x52, 0x1e, 0xce, 0xef,
+	0xbc, 0xba, 0xbe, 0xfa, 0x6f, 0x95, 0xbc, 0x39, 0x8a, 0xa5, 0xb4, 0x19, 0x60, 0xf4, 0x3b, 0x58,
+	0x08, 0x83, 0x6e, 0x4f, 0x70, 0x41, 0x07, 0xea, 0x6c, 0x3f, 0x39, 0x18, 0x5f, 0x43, 0x4b, 0x33,
+	0x81, 0xb8, 0xaa, 0x68, 0x02, 0x8f, 0x7c, 0x98, 0x97, 0x35, 0xc2, 0x8f, 0xbb, 0xe6, 0x76, 0x60,
+	0xef, 0xfa, 0x9a, 0x6a, 0x1a, 0xe0, 0xaa, 0x9e, 0x04, 0x1a, 0x05, 0x90, 0xe7, 0x82, 0x78, 0xa7,
+	0x3e, 0x0b, 0xce, 0x28, 0x53, 0x67, 0xef, 0xfc, 0x4e, 0xfd, 0xfa, 0x9a, 0x8e, 0x27, 0x20, 0x29,
+	0x35, 0x69, 0x6c, 0xc4, 0x00, 0xe2, 0x01, 0x8d, 0x3c, 0x1a, 0xf1, 0x21, 0x57, 0xc7, 0xf7, 0xfc,
+	0xce, 0xd1, 0xf5, 0x35, 0x1d, 0x0e, 0x68, 0x54, 0x55, 0x18, 0x95, 0xae, 0xcc, 0xdc, 0x2b, 0x73,
+	0x4b, 0x69, 0x41, 0x7d, 0x00, 0x7e, 0x3a, 0x7a, 0x47, 0x42, 0x99, 0xf4, 0xea, 0x06, 0x20, 0xbf,
+	0xf3, 0xd5, 0x4f, 0x98, 0xdd, 0xe9, 0xe8, 0xad, 0xc6, 0x98, 0xa2, 0x6e, 0xa2, 0xa0, 0xf4, 0x4f,
+	0x19, 0x78, 0xfc, 0xe3, 0x21, 0xec, 0xea, 0xb2, 0xb0, 0x1b, 0xfb, 0x23, 0x79, 0x7c, 0xef, 0x93,
+	0x73, 0x9c, 0xd4, 0x96, 0xf6, 0x48, 0x36, 0x90, 0x32, 0xd3, 0x8b, 0xee, 0x52, 0x9f, 0x9c, 0x27,
+	0xac, 0x92, 0x8c, 0x76, 0x60, 0x8d, 0x84, 0x61, 0xfc, 0x0e, 0x0f, 0x08, 0x13, 0x01, 0x09, 0x71,
+	0x9f, 0x72, 0x4e, 0xba, 0x54, 0x25, 0xbd, 0xe5, 0xae, 0xa8, 0xc1, 0x23, 0x3d, 0xf6, 0x5a, 0x0f,
+	0xa1, 0x4d, 0x28, 0x0e, 0x88, 0x77, 0x8a, 0x09, 0x37, 0xd8, 0x73, 0x8a, 0x37, 0x2f, 0x89, 0x15,
+	0xae, 0x70, 0x4b, 0xff, 0x3a, 0x0f, 0x4f, 0x3e, 0x2c, 0xfd, 0x65, 0xc5, 0x4d, 0x8e, 0xf1, 0xa6,
+	0xe2, 0x9a, 0x4f, 0x59, 0xa5, 0xd4, 0x4d, 0x57, 0x56, 0xd9, 0xae, 0x7e, 0xa3, 0xe7, 0x30, 0x9f,
+	0x14, 0xcb, 0x85, 0x59, 0xc5, 0x32, 0xe1, 0x94, 0x55, 0x72, 0x40, 0x44, 0x0f, 0x0f, 0x18, 0xed,
+	0x04, 0xe7, 0xca, 0xde, 0x05, 0x17, 0x24, 0xe9, 0x48, 0x51, 0xd0, 0x5d, 0x58, 0xe8, 0x90, 0x20,
+	0xc4, 0x72, 0x79, 0x4d, 0x11, 0xb5, 0x24, 0x41, 0x06, 0x04, 0x7a, 0x02, 0x4b, 0xb2, 0x6f, 0x1f,
+	0x72, 0x1c, 0x47, 0x98, 0x32, 0x16, 0x33, 0x95, 0x9f, 0x0b, 0x6e, 0x51, 0x93, 0x0f, 0xa3, 0xba,
+	0x24, 0xa2, 0x5f, 0x81, 0x13, 0x44, 0x5e, 0x38, 0xf4, 0x29, 0xee, 0x51, 0x22, 0x3b, 0x25, 0x1c,
+	0x44, 0xd8, 0xeb, 0x51, 0xef, 0xd4, 0xb9, 0xa5, 0xf6, 0xa6, 0x35, 0x33, 0xbe, 0xa7, 0x87, 0xf7,
+	0xa3, 0xaa, 0x1c, 0x44, 0x2f, 0x61, 0x23, 0x11, 0x4c, 0x16, 0xed, 0x0a, 0x00, 0x28, 0x80, 0x7b,
+	0x86, 0xcf, 0xac, 0xe1, 0x25, 0x9c, 0x3f, 0x64, 0xe0, 0xa3, 0x04, 0x88, 0xf8, 0x7e, 0x20, 0x9d,
+	0x40, 0xc2, 0xab, 0x58, 0x79, 0xd5, 0xa8, 0xfd, 0xfe, 0x4f, 0x55, 0xd0, 0xcb, 0xfb, 0xda, 0x86,
+	0xca, 0xd8, 0x84, 0x8b, 0x76, 0xd6, 0x23, 0xc1, 0x46, 0xee, 0xc3, 0xe0, 0xfd, 0x5c, 0xe8, 0x1f,
+	0x33, 0x70, 0xff, 0xb2, 0x5b, 0xda, 0xb1, 0x3f, 0x9a, 0xcc, 0xa3, 0xa0, 0x02, 0xe0, 0xed, 0xcf,
+	0x39, 0x8f, 0x54, 0x1e, 0xb9, 0xeb, 0x17, 0x9d, 0x2d, 0x69, 0x89, 0x6d, 0x7f, 0x09, 0xf7, 0x12,
+	0xaf, 0x8a, 0x18, 0x0f, 0x07, 0x5c, 0x30, 0x4a, 0xfa, 0x32, 0x3e, 0x54, 0xc2, 0x38, 0xf3, 0x6a,
+	0xb5, 0x1c, 0xc3, 0xd3, 0x8a, 0x4f, 0x0c, 0xc7, 0x61, 0x54, 0x91, 0xe3, 0xe8, 0xaf, 0xe1, 0x7e,
+	0x4a, 0xde, 0x8f, 0xdf, 0x45, 0x13, 0x04, 0x9f, 0x46, 0x23, 0xc7, 0x52, 0x00, 0xeb, 0x63, 0x80,
+	0xda, 0x98, 0xe5, 0x30, 0xaa, 0xd1, 0x68, 0x54, 0x72, 0xe1, 0xe3, 0x0f, 0x71, 0x33, 0xb2, 0x61,
+	0xee, 0x94, 0x8e, 0x4c, 0x66, 0xc9, 0x9f, 0xb2, 0x5f, 0x3a, 0x93, 0x07, 0x1b, 0xdd, 0x73, 0xba,
+	0xfa, 0xe3, 0xcb, 0xec, 0x8b, 0x4c, 0xe9, 0x7f, 0xb2, 0xef, 0x4b, 0xda, 0xf4, 0x2e, 0xf9, 0xd3,
+	0x93, 0xf6, 0xe6, 0x07, 0x27, 0xed, 0x85, 0x9c, 0x9c, 0x9b, 0x9d, 0x93, 0xb9, 0x69, 0x39, 0x39,
+	0x3b, 0x88, 0x6e, 0xfd, 0x7f, 0x05, 0x51, 0xe9, 0x14, 0xd6, 0xa6, 0x36, 0x05, 0xd7, 0x74, 0xee,
+	0xc7, 0xb0, 0x28, 0xcb, 0xbd, 0x20, 0x5d, 0x1c, 0xd2, 0xa8, 0x2b, 0x7a, 0xca, 0x59, 0x45, 0xb7,
+	0xd0, 0x27, 0xe7, 0x2d, 0xd2, 0x6d, 0x2a, 0x5a, 0xe9, 0x1f, 0x32, 0xe0, 0xfc, 0x58, 0x73, 0x70,
+	0x4d, 0x85, 0x8f, 0xa0, 0x60, 0xae, 0x60, 0x45, 0x7c, 0x6a, 0xd6, 0x66, 0xc1, 0xcd, 0x6b, 0x5a,
+	0x4b, 0x92, 0xa6, 0xd8, 0x94, 0x9b, 0x62, 0x53, 0x08, 0xb7, 0xa7, 0x77, 0x11, 0x7f, 0x12, 0x0f,
+	0x84, 0xb0, 0xfe, 0xa3, 0x7b, 0xed, 0xcf, 0xee, 0x81, 0xd2, 0x7f, 0x65, 0x61, 0x65, 0x4a, 0xe3,
+	0x22, 0xb3, 0xcf, 0xa7, 0xed, 0x61, 0xd7, 0x9c, 0x41, 0xf4, 0x07, 0x6a, 0x81, 0x23, 0x67, 0x10,
+	0x0d, 0xfb, 0x6d, 0xca, 0x70, 0xdc, 0xc1, 0x44, 0x08, 0x16, 0xb4, 0x87, 0x72, 0x77, 0xd5, 0xed,
+	0xf7, 0xdd, 0x2b, 0x19, 0xb3, 0x1f, 0x89, 0x2f, 0x3e, 0x37, 0x77, 0x1f, 0x7d, 0x72, 0x7e, 0xa0,
+	0x64, 0x0f, 0x3b, 0x95, 0xb1, 0x24, 0x7a, 0x03, 0xeb, 0x97, 0x50, 0xa3, 0x28, 0x16, 0x2a, 0x44,
+	0xb9, 0xe9, 0xa3, 0xdf, 0x0b, 0x7b, 0x3b, 0x0d, 0x3b, 0x11, 0x45, 0xdf, 0xc1, 0xbd, 0x8b, 0xb8,
+	0xa6, 0x69, 0xc0, 0xf4, 0x8c, 0x46, 0x82, 0x9b, 0x1e, 0xf9, 0xbd, 0xd0, 0x4e, 0x0a, 0xda, 0xf4,
+	0x15, 0x75, 0x25, 0x3c, 0x65, 0x31, 0x6f, 0x4e, 0x59, 0xcc, 0x3f, 0x66, 0xe1, 0xc1, 0xfb, 0xbb,
+	0xb5, 0x6b, 0x2e, 0xe9, 0x3b, 0x98, 0xf7, 0xe2, 0x48, 0xd0, 0x73, 0xa1, 0x4e, 0xd8, 0x8b, 0x3b,
+	0xbf, 0xfd, 0xb9, 0xdb, 0xc7, 0xb2, 0xfc, 0xa6, 0x55, 0xad, 0xc4, 0x4d, 0xb4, 0x7d, 0x58, 0xaa,
+	0x6c, 0x52, 0x28, 0xa4, 0xc5, 0xd1, 0x12, 0xe4, 0x4f, 0x0e, 0x8e, 0x8f, 0xea, 0xd5, 0xfd, 0x97,
+	0xfb, 0xf5, 0x9a, 0x7d, 0x03, 0xad, 0xc1, 0xf2, 0xdb, 0xe7, 0x55, 0xdc, 0x72, 0x2b, 0xd5, 0x3a,
+	0xae, 0x1e, 0x1e, 0xb4, 0xea, 0x5f, 0xb7, 0xec, 0x0c, 0x2a, 0x80, 0xf5, 0xca, 0x3d, 0xaa, 0xe2,
+	0xdd, 0xfd, 0x03, 0x3b, 0x8b, 0xee, 0xc0, 0x4a, 0xb5, 0x79, 0x78, 0x52, 0xbb, 0xc4, 0x36, 0x87,
+	0x6e, 0x41, 0x76, 0xf7, 0xb9, 0x9d, 0xdb, 0x05, 0xb0, 0x92, 0x0b, 0xa3, 0xd2, 0xa7, 0x60, 0x5f,
+	0xbe, 0x0b, 0x92, 0x3e, 0x4d, 0x5e, 0x98, 0x8c, 0x4f, 0xcd, 0xe7, 0x66, 0x03, 0xd6, 0xa6, 0xbe,
+	0x6e, 0x5d, 0xb5, 0x74, 0x1e, 0xe6, 0x0e, 0x5f, 0xbe, 0xb4, 0x33, 0x28, 0x0f, 0xf3, 0xb5, 0xfa,
+	0xcb, 0xca, 0x49, 0xb3, 0x65, 0x67, 0x11, 0xc0, 0xad, 0xe3, 0x96, 0xbb, 0x5f, 0x6d, 0xd9, 0x73,
+	0x9b, 0x4f, 0x00, 0x64, 0x3d, 0x35, 0xb7, 0x3d, 0x16, 0xe4, 0x0e, 0x0e, 0x0f, 0xea, 0xf6, 0x0d,
+	0xb4, 0x08, 0xf0, 0xfa, 0x44, 0x5d, 0xbc, 0xb4, 0x9a, 0xc7, 0x76, 0x66, 0xf3, 0x13, 0x58, 0xbe,
+	0xf2, 0x80, 0x24, 0xd9, 0xd5, 0xa4, 0x6e, 0xc8, 0x5f, 0x8d, 0xe3, 0xc3, 0x03, 0x3b, 0xb3, 0xb9,
+	0x03, 0x4b, 0x97, 0x6e, 0x7a, 0x11, 0x82, 0xc5, 0xda, 0x21, 0x3e, 0x38, 0x6c, 0xe1, 0x93, 0xa3,
+	0x57, 0x6e, 0xa5, 0x26, 0xf1, 0xf3, 0x30, 0x9f, 0x7c, 0x64, 0x1a, 0x39, 0x2b, 0x63, 0x67, 0x1b,
+	0x39, 0x2b, 0x6b, 0xcf, 0x35, 0x72, 0xd6, 0x9c, 0x9d, 0x6b, 0xe4, 0xac, 0xcf, 0xec, 0x67, 0x8d,
+	0x9c, 0xb5, 0x6e, 0x97, 0x1a, 0x39, 0xeb, 0x81, 0xfd, 0xb0, 0x91, 0xb3, 0xc0, 0xce, 0x37, 0x72,
+	0x56, 0xde, 0x2e, 0x34, 0x72, 0xd6, 0x92, 0x6d, 0x37, 0x72, 0x96, 0x6d, 0x2f, 0x37, 0x72, 0x16,
+	0xb2, 0x57, 0x1a, 0x39, 0x6b, 0xc5, 0x5e, 0x6d, 0xe4, 0xac, 0x55, 0x7b, 0xad, 0x91, 0xb3, 0xd6,
+	0xec, 0xdb, 0x8d, 0x9c, 0x75, 0xc7, 0x76, 0x1a, 0x39, 0xeb, 0xbe, 0xfd, 0xa0, 0x91, 0xb3, 0x7e,
+	0x69, 0x7f, 0xd1, 0xc8, 0x59, 0x8f, 0xed, 0x27, 0x8d, 0x9c, 0xf5, 0xc4, 0xfe, 0xa4, 0x91, 0xb3,
+	0x3e, 0xb1, 0xb7, 0x5c, 0xd4, 0x0f, 0xce, 0x29, 0xd3, 0x9b, 0x93, 0x7a, 0x32, 0xa0, 0xcc, 0x5d,
+	0xd1, 0x34, 0x46, 0xd5, 0x6d, 0xbf, 0x21, 0xae, 0x25, 0xcf, 0x59, 0xfa, 0xca, 0x5b, 0x4b, 0x70,
+	0x77, 0xfc, 0xca, 0xa5, 0x65, 0xd4, 0x7b, 0xb1, 0x16, 0xe4, 0xee, 0xed, 0x34, 0x2b, 0x1e, 0xef,
+	0xae, 0xee, 0x63, 0x1e, 0xf8, 0xd4, 0x23, 0x4c, 0x36, 0x23, 0x82, 0x86, 0xb4, 0x4f, 0x85, 0xba,
+	0xd9, 0xe3, 0xea, 0x92, 0x92, 0x74, 0x3a, 0x41, 0x14, 0x88, 0x91, 0x9b, 0x97, 0xc7, 0x70, 0xa3,
+	0xce, 0x5d, 0x66, 0xfe, 0xe4, 0xe6, 0xde, 0xa7, 0x21, 0x19, 0xb9, 0x45, 0xad, 0xd2, 0x5c, 0x98,
+	0xb8, 0xc9, 0xab, 0x9d, 0xbe, 0x69, 0x55, 0x17, 0x14, 0x17, 0x6c, 0x75, 0x0b, 0xdc, 0xe7, 0x78,
+	0xe8, 0x73, 0x2c, 0x3b, 0x71, 0x77, 0x99, 0x5f, 0x01, 0xbc, 0x6d, 0x10, 0xe4, 0x88, 0xaa, 0xb4,
+	0xb8, 0x1f, 0x0f, 0x23, 0xe1, 0x22, 0x25, 0xc8, 0x29, 0x3e, 0x7d, 0xc1, 0x31, 0x27, 0xf8, 0x77,
+	0xef, 0x84, 0x5b, 0x12, 0x94, 0xf5, 0x93, 0xc7, 0x11, 0x9f, 0x91, 0x20, 0xc2, 0xc9, 0x7f, 0x03,
+	0xdc, 0xd5, 0xc4, 0x27, 0xc6, 0x83, 0x6d, 0x22, 0xbc, 0x9e, 0xeb, 0xa4, 0xbf, 0xb0, 0x4c, 0x42,
+	0x1a, 0x09, 0x16, 0x50, 0xee, 0xae, 0x5d, 0x19, 0x91, 0x4d, 0xc9, 0xe6, 0x1f, 0x32, 0x50, 0x48,
+	0xbf, 0x91, 0xfd, 0x5f, 0x5e, 0x16, 0x1d, 0xc1, 0x2a, 0x1f, 0xb6, 0xb9, 0xc7, 0x82, 0x36, 0xf5,
+	0x31, 0xa3, 0xc9, 0x7b, 0x9e, 0x2e, 0x56, 0xf7, 0xa7, 0x16, 0x2b, 0xd7, 0x70, 0xb9, 0x2b, 0x13,
+	0xd1, 0x84, 0xc6, 0x37, 0xbf, 0x82, 0x7c, 0xea, 0xba, 0x52, 0x9e, 0x91, 0x38, 0xf5, 0x18, 0x35,
+	0xef, 0x13, 0x7a, 0x3e, 0xa0, 0x49, 0xea, 0x49, 0xe2, 0x2e, 0x2c, 0xf8, 0x11, 0xd7, 0x4f, 0x47,
+	0xe6, 0xae, 0xcd, 0xf2, 0x23, 0xae, 0x5e, 0x8d, 0x9e, 0x6e, 0x80, 0x95, 0x20, 0xa3, 0x55, 0xb0,
+	0x93, 0x8b, 0xd1, 0xe4, 0x3a, 0xd5, 0xbe, 0xb1, 0xbb, 0xf5, 0x1f, 0x3f, 0x3c, 0xc8, 0xfc, 0xe7,
+	0x0f, 0x0f, 0x32, 0xff, 0xfd, 0xc3, 0x83, 0xcc, 0xb7, 0x25, 0x6d, 0xaf, 0xfe, 0x0b, 0xc5, 0xf6,
+	0x85, 0x3f, 0x65, 0xb4, 0x6f, 0xa9, 0x0d, 0xe3, 0xf9, 0xff, 0x06, 0x00, 0x00, 0xff, 0xff, 0x13,
+	0xec, 0x22, 0xb3, 0x1d, 0x22, 0x00, 0x00,
 }
 
 func (m *MeshConfig) Marshal() (dAtA []byte, err error) {
@@ -3306,6 +3320,15 @@ func (m *MeshConfig_CertificateData) MarshalToSizedBuffer(dAtA []byte) (int, err
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.TrustDomains) > 0 {
+		for iNdEx := len(m.TrustDomains) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.TrustDomains[iNdEx])
+			copy(dAtA[i:], m.TrustDomains[iNdEx])
+			i = encodeVarintConfig(dAtA, i, uint64(len(m.TrustDomains[iNdEx])))
+			i--
+			dAtA[i] = 0x1a
+		}
+	}
 	if m.CertificateData != nil {
 		{
 			size := m.CertificateData.Size()
@@ -4715,6 +4738,12 @@ func (m *MeshConfig_CertificateData) Size() (n int) {
 	if m.CertificateData != nil {
 		n += m.CertificateData.Size()
 	}
+	if len(m.TrustDomains) > 0 {
+		for _, s := range m.TrustDomains {
+			l = len(s)
+			n += 1 + l + sovConfig(uint64(l))
+		}
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -6745,6 +6774,38 @@ func (m *MeshConfig_CertificateData) Unmarshal(dAtA []byte) error {
 			}
 			m.CertificateData = &MeshConfig_CertificateData_SpiffeBundleUrl{string(dAtA[iNdEx:postIndex])}
 			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TrustDomains", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowConfig
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthConfig
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthConfig
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.TrustDomains = append(m.TrustDomains, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipConfig(dAtA[iNdEx:])
diff --git a/mesh/v1alpha1/config.proto b/mesh/v1alpha1/config.proto
index 73bf563f8a1..ef00d6653ab 100644
--- a/mesh/v1alpha1/config.proto
+++ b/mesh/v1alpha1/config.proto
@@ -222,6 +222,13 @@ message MeshConfig {
       // The certificate is retrieved from the endpoint.
       string spiffe_bundle_url = 2;
     }
+
+    // Optional. Specify the list of trust domains to which this certificate data belongs.
+    // If set, they are used for this root CA. Otherwise, this root CA is used for default trust domain
+    // and its aliases.
+    // Note that we can have multiple certificate data for a same trust_domain.
+    // In that case, certificates with a same trust domain will be merged and used together to verify peer certificates.
+    repeated string trust_domains = 3;
   }
 
   // The extra root certificates for workload-to-workload communication.
diff --git a/mesh/v1alpha1/istio.mesh.v1alpha1.gen.json b/mesh/v1alpha1/istio.mesh.v1alpha1.gen.json
index 1fe2d2fce33..abda327dd7f 100644
--- a/mesh/v1alpha1/istio.mesh.v1alpha1.gen.json
+++ b/mesh/v1alpha1/istio.mesh.v1alpha1.gen.json
@@ -411,6 +411,16 @@
       },
       "istio.mesh.v1alpha1.MeshConfig.CertificateData": {
         "type": "object",
+        "properties": {
+          "trustDomains": {
+            "description": "Optional. Specify the list of trust domains to which this certificate data belongs. If set, they are used for this root CA. Otherwise, this root CA is used for default trust domain and its aliases. Note that we can have multiple certificate data for a same trust_domain. In that case, certificates with a same trust domain will be merged and used together to verify peer certificates.",
+            "type": "array",
+            "items": {
+              "type": "string",
+              "format": "string"
+            }
+          }
+        },
         "oneOf": [
           {
             "not": {
diff --git a/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html b/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
index 2a2136e85fa..7bbea906aab 100644
--- a/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
+++ b/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
@@ -816,6 +816,21 @@ <h2 id="MeshConfig-CertificateData">MeshConfig.CertificateData</h2>
 https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE<em>Trust</em>Domain<em>and</em>Bundle.md#521-web-pki
 The certificate is retrieved from the endpoint.</p>
 
+</td>
+<td>
+No
+</td>
+</tr>
+<tr id="MeshConfig-CertificateData-trust_domains">
+<td><code>trustDomains</code></td>
+<td><code>string[]</code></td>
+<td>
+<p>Optional. Specify the list of trust domains to which this certificate data belongs.
+If set, they are used for this root CA. Otherwise, this root CA is used for default trust domain
+and its aliases.
+Note that we can have multiple certificate data for a same trust_domain.
+In that case, certificates with a same trust domain will be merged and used together to verify peer certificates.</p>
+
 </td>
 <td>
 No
diff --git a/python/istio_api/mesh/v1alpha1/config_pb2.py b/python/istio_api/mesh/v1alpha1/config_pb2.py
index 414b867bddc..d82ad4aed3f 100644
--- a/python/istio_api/mesh/v1alpha1/config_pb2.py
+++ b/python/istio_api/mesh/v1alpha1/config_pb2.py
@@ -26,7 +26,7 @@
   package='istio.mesh.v1alpha1',
   syntax='proto3',
   serialized_options=_b('Z\032istio.io/api/mesh/v1alpha1'),
-  serialized_pb=_b('\n\x1amesh/v1alpha1/config.proto\x12\x13istio.mesh.v1alpha1\x1a\x1egoogle/protobuf/duration.proto\x1a\x1egoogle/protobuf/wrappers.proto\x1a\x19mesh/v1alpha1/proxy.proto\x1a*networking/v1alpha3/destination_rule.proto\x1a\x34k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto\"\x97?\n\nMeshConfig\x12*\n\x11proxy_listen_port\x18\x04 \x01(\x05R\x0fproxyListenPort\x12&\n\x0fproxy_http_port\x18\x05 \x01(\x05R\rproxyHttpPort\x12\x42\n\x0f\x63onnect_timeout\x18\x06 \x01(\x0b\x32\x19.google.protobuf.DurationR\x0e\x63onnectTimeout\x12W\n\x1aprotocol_detection_timeout\x18* \x01(\x0b\x32\x19.google.protobuf.DurationR\x18protocolDetectionTimeout\x12o\n\rtcp_keepalive\x18\x1c \x01(\x0b\x32J.istio.networking.v1alpha3.ConnectionPoolSettings.TCPSettings.TcpKeepaliveR\x0ctcpKeepalive\x12#\n\ringress_class\x18\x07 \x01(\tR\x0cingressClass\x12\'\n\x0fingress_service\x18\x08 \x01(\tR\x0eingressService\x12m\n\x17ingress_controller_mode\x18\t \x01(\x0e\x32\x35.istio.mesh.v1alpha1.MeshConfig.IngressControllerModeR\x15ingressControllerMode\x12)\n\x10ingress_selector\x18\x34 \x01(\tR\x0fingressSelector\x12%\n\x0e\x65nable_tracing\x18\x0c \x01(\x08R\renableTracing\x12&\n\x0f\x61\x63\x63\x65ss_log_file\x18\r \x01(\tR\raccessLogFile\x12*\n\x11\x61\x63\x63\x65ss_log_format\x18\x18 \x01(\tR\x0f\x61\x63\x63\x65ssLogFormat\x12\x61\n\x13\x61\x63\x63\x65ss_log_encoding\x18\x1b \x01(\x0e\x32\x31.istio.mesh.v1alpha1.MeshConfig.AccessLogEncodingR\x11\x61\x63\x63\x65ssLogEncoding\x12\x44\n\x1f\x65nable_envoy_access_log_service\x18( \x01(\x08R\x1b\x65nableEnvoyAccessLogService\x12;\n\x1a\x64isable_envoy_listener_log\x18\x38 \x01(\x08R\x17\x64isableEnvoyListenerLog\x12G\n\x0e\x64\x65\x66\x61ult_config\x18\x0e \x01(\x0b\x32 .istio.mesh.v1alpha1.ProxyConfigR\rdefaultConfig\x12m\n\x17outbound_traffic_policy\x18\x11 \x01(\x0b\x32\x35.istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicyR\x15outboundTrafficPolicy\x12H\n\x0e\x63onfig_sources\x18\x16 \x03(\x0b\x32!.istio.mesh.v1alpha1.ConfigSourceR\rconfigSources\x12\x44\n\x10\x65nable_auto_mtls\x18+ \x01(\x0b\x32\x1a.google.protobuf.BoolValueR\x0e\x65nableAutoMtls\x12!\n\x0ctrust_domain\x18\x1a \x01(\tR\x0btrustDomain\x12\x30\n\x14trust_domain_aliases\x18. \x03(\tR\x12trustDomainAliases\x12X\n\x0f\x63\x61_certificates\x18: \x03(\x0b\x32/.istio.mesh.v1alpha1.MeshConfig.CertificateDataR\x0e\x63\x61\x43\x65rtificates\x12\x39\n\x19\x64\x65\x66\x61ult_service_export_to\x18\x1f \x03(\tR\x16\x64\x65\x66\x61ultServiceExportTo\x12H\n!default_virtual_service_export_to\x18  \x03(\tR\x1d\x64\x65\x66\x61ultVirtualServiceExportTo\x12J\n\"default_destination_rule_export_to\x18! \x03(\tR\x1e\x64\x65\x66\x61ultDestinationRuleExportTo\x12%\n\x0eroot_namespace\x18\" \x01(\tR\rrootNamespace\x12\x66\n\x13locality_lb_setting\x18# \x01(\x0b\x32\x36.istio.networking.v1alpha3.LocalityLoadBalancerSettingR\x11localityLbSetting\x12\x43\n\x10\x64ns_refresh_rate\x18$ \x01(\x0b\x32\x19.google.protobuf.DurationR\x0e\x64nsRefreshRate\x12[\n\x11h2_upgrade_policy\x18) \x01(\x0e\x32/.istio.mesh.v1alpha1.MeshConfig.H2UpgradePolicyR\x0fh2UpgradePolicy\x12\x39\n\x19inbound_cluster_stat_name\x18, \x01(\tR\x16inboundClusterStatName\x12;\n\x1aoutbound_cluster_stat_name\x18- \x01(\tR\x17outboundClusterStatName\x12\x44\n\x0c\x63\x65rtificates\x18/ \x03(\x0b\x32 .istio.mesh.v1alpha1.CertificateR\x0c\x63\x65rtificates\x12Q\n\rthrift_config\x18\x31 \x01(\x0b\x32,.istio.mesh.v1alpha1.MeshConfig.ThriftConfigR\x0cthriftConfig\x12Z\n\x10service_settings\x18\x32 \x03(\x0b\x32/.istio.mesh.v1alpha1.MeshConfig.ServiceSettingsR\x0fserviceSettings\x12R\n\x17\x65nable_prometheus_merge\x18\x33 \x01(\x0b\x32\x1a.google.protobuf.BoolValueR\x15\x65nablePrometheusMerge\x12[\n\x1cverify_certificate_at_client\x18\x36 \x01(\x0b\x32\x1a.google.protobuf.BoolValueR\x19verifyCertificateAtClient\x12\x32\n\x02\x63\x61\x18\x37 \x01(\x0b\x32\".istio.mesh.v1alpha1.MeshConfig.CAR\x02\x63\x61\x12\x62\n\x13\x65xtension_providers\x18\x39 \x03(\x0b\x32\x31.istio.mesh.v1alpha1.MeshConfig.ExtensionProviderR\x12\x65xtensionProviders\x12]\n\x11\x64\x65\x66\x61ult_providers\x18< \x01(\x0b\x32\x30.istio.mesh.v1alpha1.MeshConfig.DefaultProvidersR\x10\x64\x65\x66\x61ultProviders\x12\x64\n\x13\x64iscovery_selectors\x18; \x03(\x0b\x32\x33.k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelectorR\x12\x64iscoverySelectors\x1a\xad\x01\n\x15OutboundTrafficPolicy\x12N\n\x04mode\x18\x01 \x01(\x0e\x32:.istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicy.ModeR\x04mode\"D\n\x04Mode\x12\x11\n\rREGISTRY_ONLY\x10\x00\x12\r\n\tALLOW_ANY\x10\x01\"\x04\x08\x02\x10\x02*\x14VIRTUAL_SERVICE_ONLY\x1ag\n\x0f\x43\x65rtificateData\x12\x12\n\x03pem\x18\x01 \x01(\tH\x00R\x03pem\x12,\n\x11spiffe_bundle_url\x18\x02 \x01(\tH\x00R\x0fspiffeBundleUrlB\x12\n\x10\x63\x65rtificate_data\x1a}\n\x0cThriftConfig\x12$\n\x0erate_limit_url\x18\x01 \x01(\tR\x0crateLimitUrl\x12G\n\x12rate_limit_timeout\x18\x02 \x01(\x0b\x32\x19.google.protobuf.DurationR\x10rateLimitTimeout\x1a\xae\x01\n\x0fServiceSettings\x12T\n\x08settings\x18\x01 \x01(\x0b\x32\x38.istio.mesh.v1alpha1.MeshConfig.ServiceSettings.SettingsR\x08settings\x12\x14\n\x05hosts\x18\x02 \x03(\tR\x05hosts\x1a/\n\x08Settings\x12#\n\rcluster_local\x18\x01 \x01(\x08R\x0c\x63lusterLocal\x1a\xd4\x01\n\x02\x43\x41\x12\x18\n\x07\x61\x64\x64ress\x18\x01 \x01(\tR\x07\x61\x64\x64ress\x12O\n\x0ctls_settings\x18\x02 \x01(\x0b\x32,.istio.networking.v1alpha3.ClientTLSSettingsR\x0btlsSettings\x12\x42\n\x0frequest_timeout\x18\x03 \x01(\x0b\x32\x19.google.protobuf.DurationR\x0erequestTimeout\x12\x1f\n\x0bistiod_side\x18\x04 \x01(\x08R\nistiodSide\x1a\xb7\x1c\n\x11\x45xtensionProvider\x12\x12\n\x04name\x18\x01 \x01(\tR\x04name\x12\x8b\x01\n\x14\x65nvoy_ext_authz_http\x18\x02 \x01(\x0b\x32X.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.EnvoyExternalAuthorizationHttpProviderH\x00R\x11\x65nvoyExtAuthzHttp\x12\x8b\x01\n\x14\x65nvoy_ext_authz_grpc\x18\x03 \x01(\x0b\x32X.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.EnvoyExternalAuthorizationGrpcProviderH\x00R\x11\x65nvoyExtAuthzGrpc\x12\x61\n\x06zipkin\x18\x04 \x01(\x0b\x32G.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.ZipkinTracingProviderH\x00R\x06zipkin\x12j\n\tlightstep\x18\x05 \x01(\x0b\x32J.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.LightstepTracingProviderH\x00R\tlightstep\x12\x64\n\x07\x64\x61tadog\x18\x06 \x01(\x0b\x32H.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.DatadogTracingProviderH\x00R\x07\x64\x61tadog\x12i\n\x0bstackdriver\x18\x07 \x01(\x0b\x32\x45.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.StackdriverProviderH\x00R\x0bstackdriver\x12r\n\nopencensus\x18\x08 \x01(\x0b\x32P.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.OpenCensusAgentTracingProviderH\x00R\nopencensus\x12m\n\nskywalking\x18\t \x01(\x0b\x32K.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.SkyWalkingTracingProviderH\x00R\nskywalking\x1a\xab\x01\n%EnvoyExternalAuthorizationRequestBody\x12*\n\x11max_request_bytes\x18\x01 \x01(\rR\x0fmaxRequestBytes\x12\x32\n\x15\x61llow_partial_message\x18\x02 \x01(\x08R\x13\x61llowPartialMessage\x12\"\n\rpack_as_bytes\x18\x03 \x01(\x08R\x0bpackAsBytes\x1a\xb2\x07\n&EnvoyExternalAuthorizationHttpProvider\x12\x18\n\x07service\x18\x01 \x01(\tR\x07service\x12\x12\n\x04port\x18\x02 \x01(\rR\x04port\x12\x33\n\x07timeout\x18\t \x01(\x0b\x32\x19.google.protobuf.DurationR\x07timeout\x12\x1f\n\x0bpath_prefix\x18\x03 \x01(\tR\npathPrefix\x12\x1b\n\tfail_open\x18\x04 \x01(\x08R\x08\x66\x61ilOpen\x12&\n\x0fstatus_on_error\x18\x05 \x01(\tR\rstatusOnError\x12\x37\n\x18include_headers_in_check\x18\x06 \x03(\tR\x15includeHeadersInCheck\x12\x46\n include_request_headers_in_check\x18\n \x03(\tR\x1cincludeRequestHeadersInCheck\x12\xcb\x01\n#include_additional_headers_in_check\x18\x0b \x03(\x0b\x32}.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.EnvoyExternalAuthorizationHttpProvider.IncludeAdditionalHeadersInCheckEntryR\x1fincludeAdditionalHeadersInCheck\x12\x99\x01\n\x1dinclude_request_body_in_check\x18\x0c \x01(\x0b\x32W.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.EnvoyExternalAuthorizationRequestBodyR\x19includeRequestBodyInCheck\x12>\n\x1cheaders_to_upstream_on_allow\x18\x07 \x03(\tR\x18headersToUpstreamOnAllow\x12@\n\x1dheaders_to_downstream_on_deny\x18\x08 \x03(\tR\x19headersToDownstreamOnDeny\x1aR\n$IncludeAdditionalHeadersInCheckEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n\x05value\x18\x02 \x01(\tR\x05value:\x02\x38\x01\x1a\xec\x02\n&EnvoyExternalAuthorizationGrpcProvider\x12\x18\n\x07service\x18\x01 \x01(\tR\x07service\x12\x12\n\x04port\x18\x02 \x01(\rR\x04port\x12\x33\n\x07timeout\x18\x05 \x01(\x0b\x32\x19.google.protobuf.DurationR\x07timeout\x12\x1b\n\tfail_open\x18\x03 \x01(\x08R\x08\x66\x61ilOpen\x12&\n\x0fstatus_on_error\x18\x04 \x01(\tR\rstatusOnError\x12\x99\x01\n\x1dinclude_request_body_in_check\x18\x06 \x01(\x0b\x32W.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.EnvoyExternalAuthorizationRequestBodyR\x19includeRequestBodyInCheck\x1ak\n\x15ZipkinTracingProvider\x12\x18\n\x07service\x18\x01 \x01(\tR\x07service\x12\x12\n\x04port\x18\x02 \x01(\rR\x04port\x12$\n\x0emax_tag_length\x18\x03 \x01(\rR\x0cmaxTagLength\x1a\x91\x01\n\x18LightstepTracingProvider\x12\x18\n\x07service\x18\x01 \x01(\tR\x07service\x12\x12\n\x04port\x18\x02 \x01(\rR\x04port\x12!\n\x0c\x61\x63\x63\x65ss_token\x18\x03 \x01(\tR\x0b\x61\x63\x63\x65ssToken\x12$\n\x0emax_tag_length\x18\x04 \x01(\rR\x0cmaxTagLength\x1al\n\x16\x44\x61tadogTracingProvider\x12\x18\n\x07service\x18\x01 \x01(\tR\x07service\x12\x12\n\x04port\x18\x02 \x01(\rR\x04port\x12$\n\x0emax_tag_length\x18\x03 \x01(\rR\x0cmaxTagLength\x1al\n\x19SkyWalkingTracingProvider\x12\x18\n\x07service\x18\x01 \x01(\tR\x07service\x12\x12\n\x04port\x18\x02 \x01(\rR\x04port\x12!\n\x0c\x61\x63\x63\x65ss_token\x18\x03 \x01(\tR\x0b\x61\x63\x63\x65ssToken\x1a\xdc\x02\n\x13StackdriverProvider\x12\x14\n\x05\x64\x65\x62ug\x18\x01 \x01(\x08R\x05\x64\x65\x62ug\x12T\n\x18max_number_of_attributes\x18\x02 \x01(\x0b\x32\x1b.google.protobuf.Int64ValueR\x15maxNumberOfAttributes\x12V\n\x19max_number_of_annotations\x18\x03 \x01(\x0b\x32\x1b.google.protobuf.Int64ValueR\x16maxNumberOfAnnotations\x12[\n\x1cmax_number_of_message_events\x18\x04 \x01(\x0b\x32\x1b.google.protobuf.Int64ValueR\x18maxNumberOfMessageEvents\x12$\n\x0emax_tag_length\x18\x05 \x01(\rR\x0cmaxTagLength\x1a\xd4\x02\n\x1eOpenCensusAgentTracingProvider\x12\x18\n\x07service\x18\x01 \x01(\tR\x07service\x12\x12\n\x04port\x18\x02 \x01(\rR\x04port\x12w\n\x07\x63ontext\x18\x03 \x03(\x0e\x32].istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.OpenCensusAgentTracingProvider.TraceContextR\x07\x63ontext\x12$\n\x0emax_tag_length\x18\x04 \x01(\rR\x0cmaxTagLength\"e\n\x0cTraceContext\x12\x0f\n\x0bUNSPECIFIED\x10\x00\x12\x15\n\x11W3C_TRACE_CONTEXT\x10\x01\x12\x0c\n\x08GRPC_BIN\x10\x02\x12\x17\n\x13\x43LOUD_TRACE_CONTEXT\x10\x03\x12\x06\n\x02\x42\x33\x10\x04\x42\n\n\x08provider\x1a,\n\x10\x44\x65\x66\x61ultProviders\x12\x18\n\x07tracing\x18\x01 \x01(\tR\x07tracing\"J\n\x15IngressControllerMode\x12\x0f\n\x0bUNSPECIFIED\x10\x00\x12\x07\n\x03OFF\x10\x01\x12\x0b\n\x07\x44\x45\x46\x41ULT\x10\x02\x12\n\n\x06STRICT\x10\x03\"&\n\nAuthPolicy\x12\x08\n\x04NONE\x10\x00\x12\x0e\n\nMUTUAL_TLS\x10\x01\"\'\n\x11\x41\x63\x63\x65ssLogEncoding\x12\x08\n\x04TEXT\x10\x00\x12\x08\n\x04JSON\x10\x01\"2\n\x0fH2UpgradePolicy\x12\x12\n\x0e\x44O_NOT_UPGRADE\x10\x00\x12\x0b\n\x07UPGRADE\x10\x01J\x04\x08\x01\x10\x02J\x04\x08\x02\x10\x03J\x04\x08\x03\x10\x04J\x04\x08\x30\x10\x31J\x04\x08\x19\x10\x1aJ\x04\x08\x1e\x10\x1fJ\x04\x08\n\x10\x0bJ\x04\x08\x0b\x10\x0cJ\x04\x08\x0f\x10\x10J\x04\x08\x10\x10\x11J\x04\x08\x12\x10\x13J\x04\x08\x13\x10\x14J\x04\x08\x14\x10\x15J\x04\x08\x15\x10\x16J\x04\x08\x17\x10\x18J\x04\x08\x1d\x10\x1eJ\x04\x08\x35\x10\x36J\x04\x08%\x10&J\x04\x08&\x10\'J\x04\x08\'\x10(R\x12mixer_check_serverR\x13mixer_report_serverR\x15\x64isable_policy_checksR\x1a\x64isable_mixer_http_reportsR\x16policy_check_fail_openR%sidecar_to_telemetry_session_affinityR\x0b\x61uth_policyR\x11rds_refresh_delayR\rmixer_addressR\x1f\x65nable_client_side_policy_checkR\x0csds_uds_pathR\x11sds_refresh_delayR\x16\x65nable_sds_token_mountR\x12sds_use_k8s_sa_jwtR\x1atermination_drain_durationR\x14\x64isable_report_batchR\x18report_batch_max_entriesR\x15report_batch_max_time\"\xcb\x01\n\x0c\x43onfigSource\x12\x18\n\x07\x61\x64\x64ress\x18\x01 \x01(\tR\x07\x61\x64\x64ress\x12O\n\x0ctls_settings\x18\x02 \x01(\x0b\x32,.istio.networking.v1alpha3.ClientTLSSettingsR\x0btlsSettings\x12P\n\x14subscribed_resources\x18\x03 \x03(\x0e\x32\x1d.istio.mesh.v1alpha1.ResourceR\x13subscribedResources\"K\n\x0b\x43\x65rtificate\x12\x1f\n\x0bsecret_name\x18\x01 \x01(\tR\nsecretName\x12\x1b\n\tdns_names\x18\x02 \x03(\tR\x08\x64nsNames* \n\x08Resource\x12\x14\n\x10SERVICE_REGISTRY\x10\x00\x42\x1cZ\x1aistio.io/api/mesh/v1alpha1b\x06proto3')
+  serialized_pb=_b('\n\x1amesh/v1alpha1/config.proto\x12\x13istio.mesh.v1alpha1\x1a\x1egoogle/protobuf/duration.proto\x1a\x1egoogle/protobuf/wrappers.proto\x1a\x19mesh/v1alpha1/proxy.proto\x1a*networking/v1alpha3/destination_rule.proto\x1a\x34k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto\"\xbd?\n\nMeshConfig\x12*\n\x11proxy_listen_port\x18\x04 \x01(\x05R\x0fproxyListenPort\x12&\n\x0fproxy_http_port\x18\x05 \x01(\x05R\rproxyHttpPort\x12\x42\n\x0f\x63onnect_timeout\x18\x06 \x01(\x0b\x32\x19.google.protobuf.DurationR\x0e\x63onnectTimeout\x12W\n\x1aprotocol_detection_timeout\x18* \x01(\x0b\x32\x19.google.protobuf.DurationR\x18protocolDetectionTimeout\x12o\n\rtcp_keepalive\x18\x1c \x01(\x0b\x32J.istio.networking.v1alpha3.ConnectionPoolSettings.TCPSettings.TcpKeepaliveR\x0ctcpKeepalive\x12#\n\ringress_class\x18\x07 \x01(\tR\x0cingressClass\x12\'\n\x0fingress_service\x18\x08 \x01(\tR\x0eingressService\x12m\n\x17ingress_controller_mode\x18\t \x01(\x0e\x32\x35.istio.mesh.v1alpha1.MeshConfig.IngressControllerModeR\x15ingressControllerMode\x12)\n\x10ingress_selector\x18\x34 \x01(\tR\x0fingressSelector\x12%\n\x0e\x65nable_tracing\x18\x0c \x01(\x08R\renableTracing\x12&\n\x0f\x61\x63\x63\x65ss_log_file\x18\r \x01(\tR\raccessLogFile\x12*\n\x11\x61\x63\x63\x65ss_log_format\x18\x18 \x01(\tR\x0f\x61\x63\x63\x65ssLogFormat\x12\x61\n\x13\x61\x63\x63\x65ss_log_encoding\x18\x1b \x01(\x0e\x32\x31.istio.mesh.v1alpha1.MeshConfig.AccessLogEncodingR\x11\x61\x63\x63\x65ssLogEncoding\x12\x44\n\x1f\x65nable_envoy_access_log_service\x18( \x01(\x08R\x1b\x65nableEnvoyAccessLogService\x12;\n\x1a\x64isable_envoy_listener_log\x18\x38 \x01(\x08R\x17\x64isableEnvoyListenerLog\x12G\n\x0e\x64\x65\x66\x61ult_config\x18\x0e \x01(\x0b\x32 .istio.mesh.v1alpha1.ProxyConfigR\rdefaultConfig\x12m\n\x17outbound_traffic_policy\x18\x11 \x01(\x0b\x32\x35.istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicyR\x15outboundTrafficPolicy\x12H\n\x0e\x63onfig_sources\x18\x16 \x03(\x0b\x32!.istio.mesh.v1alpha1.ConfigSourceR\rconfigSources\x12\x44\n\x10\x65nable_auto_mtls\x18+ \x01(\x0b\x32\x1a.google.protobuf.BoolValueR\x0e\x65nableAutoMtls\x12!\n\x0ctrust_domain\x18\x1a \x01(\tR\x0btrustDomain\x12\x30\n\x14trust_domain_aliases\x18. \x03(\tR\x12trustDomainAliases\x12X\n\x0f\x63\x61_certificates\x18: \x03(\x0b\x32/.istio.mesh.v1alpha1.MeshConfig.CertificateDataR\x0e\x63\x61\x43\x65rtificates\x12\x39\n\x19\x64\x65\x66\x61ult_service_export_to\x18\x1f \x03(\tR\x16\x64\x65\x66\x61ultServiceExportTo\x12H\n!default_virtual_service_export_to\x18  \x03(\tR\x1d\x64\x65\x66\x61ultVirtualServiceExportTo\x12J\n\"default_destination_rule_export_to\x18! \x03(\tR\x1e\x64\x65\x66\x61ultDestinationRuleExportTo\x12%\n\x0eroot_namespace\x18\" \x01(\tR\rrootNamespace\x12\x66\n\x13locality_lb_setting\x18# \x01(\x0b\x32\x36.istio.networking.v1alpha3.LocalityLoadBalancerSettingR\x11localityLbSetting\x12\x43\n\x10\x64ns_refresh_rate\x18$ \x01(\x0b\x32\x19.google.protobuf.DurationR\x0e\x64nsRefreshRate\x12[\n\x11h2_upgrade_policy\x18) \x01(\x0e\x32/.istio.mesh.v1alpha1.MeshConfig.H2UpgradePolicyR\x0fh2UpgradePolicy\x12\x39\n\x19inbound_cluster_stat_name\x18, \x01(\tR\x16inboundClusterStatName\x12;\n\x1aoutbound_cluster_stat_name\x18- \x01(\tR\x17outboundClusterStatName\x12\x44\n\x0c\x63\x65rtificates\x18/ \x03(\x0b\x32 .istio.mesh.v1alpha1.CertificateR\x0c\x63\x65rtificates\x12Q\n\rthrift_config\x18\x31 \x01(\x0b\x32,.istio.mesh.v1alpha1.MeshConfig.ThriftConfigR\x0cthriftConfig\x12Z\n\x10service_settings\x18\x32 \x03(\x0b\x32/.istio.mesh.v1alpha1.MeshConfig.ServiceSettingsR\x0fserviceSettings\x12R\n\x17\x65nable_prometheus_merge\x18\x33 \x01(\x0b\x32\x1a.google.protobuf.BoolValueR\x15\x65nablePrometheusMerge\x12[\n\x1cverify_certificate_at_client\x18\x36 \x01(\x0b\x32\x1a.google.protobuf.BoolValueR\x19verifyCertificateAtClient\x12\x32\n\x02\x63\x61\x18\x37 \x01(\x0b\x32\".istio.mesh.v1alpha1.MeshConfig.CAR\x02\x63\x61\x12\x62\n\x13\x65xtension_providers\x18\x39 \x03(\x0b\x32\x31.istio.mesh.v1alpha1.MeshConfig.ExtensionProviderR\x12\x65xtensionProviders\x12]\n\x11\x64\x65\x66\x61ult_providers\x18< \x01(\x0b\x32\x30.istio.mesh.v1alpha1.MeshConfig.DefaultProvidersR\x10\x64\x65\x66\x61ultProviders\x12\x64\n\x13\x64iscovery_selectors\x18; \x03(\x0b\x32\x33.k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelectorR\x12\x64iscoverySelectors\x1a\xad\x01\n\x15OutboundTrafficPolicy\x12N\n\x04mode\x18\x01 \x01(\x0e\x32:.istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicy.ModeR\x04mode\"D\n\x04Mode\x12\x11\n\rREGISTRY_ONLY\x10\x00\x12\r\n\tALLOW_ANY\x10\x01\"\x04\x08\x02\x10\x02*\x14VIRTUAL_SERVICE_ONLY\x1a\x8c\x01\n\x0f\x43\x65rtificateData\x12\x12\n\x03pem\x18\x01 \x01(\tH\x00R\x03pem\x12,\n\x11spiffe_bundle_url\x18\x02 \x01(\tH\x00R\x0fspiffeBundleUrl\x12#\n\rtrust_domains\x18\x03 \x03(\tR\x0ctrustDomainsB\x12\n\x10\x63\x65rtificate_data\x1a}\n\x0cThriftConfig\x12$\n\x0erate_limit_url\x18\x01 \x01(\tR\x0crateLimitUrl\x12G\n\x12rate_limit_timeout\x18\x02 \x01(\x0b\x32\x19.google.protobuf.DurationR\x10rateLimitTimeout\x1a\xae\x01\n\x0fServiceSettings\x12T\n\x08settings\x18\x01 \x01(\x0b\x32\x38.istio.mesh.v1alpha1.MeshConfig.ServiceSettings.SettingsR\x08settings\x12\x14\n\x05hosts\x18\x02 \x03(\tR\x05hosts\x1a/\n\x08Settings\x12#\n\rcluster_local\x18\x01 \x01(\x08R\x0c\x63lusterLocal\x1a\xd4\x01\n\x02\x43\x41\x12\x18\n\x07\x61\x64\x64ress\x18\x01 \x01(\tR\x07\x61\x64\x64ress\x12O\n\x0ctls_settings\x18\x02 \x01(\x0b\x32,.istio.networking.v1alpha3.ClientTLSSettingsR\x0btlsSettings\x12\x42\n\x0frequest_timeout\x18\x03 \x01(\x0b\x32\x19.google.protobuf.DurationR\x0erequestTimeout\x12\x1f\n\x0bistiod_side\x18\x04 \x01(\x08R\nistiodSide\x1a\xb7\x1c\n\x11\x45xtensionProvider\x12\x12\n\x04name\x18\x01 \x01(\tR\x04name\x12\x8b\x01\n\x14\x65nvoy_ext_authz_http\x18\x02 \x01(\x0b\x32X.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.EnvoyExternalAuthorizationHttpProviderH\x00R\x11\x65nvoyExtAuthzHttp\x12\x8b\x01\n\x14\x65nvoy_ext_authz_grpc\x18\x03 \x01(\x0b\x32X.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.EnvoyExternalAuthorizationGrpcProviderH\x00R\x11\x65nvoyExtAuthzGrpc\x12\x61\n\x06zipkin\x18\x04 \x01(\x0b\x32G.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.ZipkinTracingProviderH\x00R\x06zipkin\x12j\n\tlightstep\x18\x05 \x01(\x0b\x32J.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.LightstepTracingProviderH\x00R\tlightstep\x12\x64\n\x07\x64\x61tadog\x18\x06 \x01(\x0b\x32H.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.DatadogTracingProviderH\x00R\x07\x64\x61tadog\x12i\n\x0bstackdriver\x18\x07 \x01(\x0b\x32\x45.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.StackdriverProviderH\x00R\x0bstackdriver\x12r\n\nopencensus\x18\x08 \x01(\x0b\x32P.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.OpenCensusAgentTracingProviderH\x00R\nopencensus\x12m\n\nskywalking\x18\t \x01(\x0b\x32K.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.SkyWalkingTracingProviderH\x00R\nskywalking\x1a\xab\x01\n%EnvoyExternalAuthorizationRequestBody\x12*\n\x11max_request_bytes\x18\x01 \x01(\rR\x0fmaxRequestBytes\x12\x32\n\x15\x61llow_partial_message\x18\x02 \x01(\x08R\x13\x61llowPartialMessage\x12\"\n\rpack_as_bytes\x18\x03 \x01(\x08R\x0bpackAsBytes\x1a\xb2\x07\n&EnvoyExternalAuthorizationHttpProvider\x12\x18\n\x07service\x18\x01 \x01(\tR\x07service\x12\x12\n\x04port\x18\x02 \x01(\rR\x04port\x12\x33\n\x07timeout\x18\t \x01(\x0b\x32\x19.google.protobuf.DurationR\x07timeout\x12\x1f\n\x0bpath_prefix\x18\x03 \x01(\tR\npathPrefix\x12\x1b\n\tfail_open\x18\x04 \x01(\x08R\x08\x66\x61ilOpen\x12&\n\x0fstatus_on_error\x18\x05 \x01(\tR\rstatusOnError\x12\x37\n\x18include_headers_in_check\x18\x06 \x03(\tR\x15includeHeadersInCheck\x12\x46\n include_request_headers_in_check\x18\n \x03(\tR\x1cincludeRequestHeadersInCheck\x12\xcb\x01\n#include_additional_headers_in_check\x18\x0b \x03(\x0b\x32}.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.EnvoyExternalAuthorizationHttpProvider.IncludeAdditionalHeadersInCheckEntryR\x1fincludeAdditionalHeadersInCheck\x12\x99\x01\n\x1dinclude_request_body_in_check\x18\x0c \x01(\x0b\x32W.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.EnvoyExternalAuthorizationRequestBodyR\x19includeRequestBodyInCheck\x12>\n\x1cheaders_to_upstream_on_allow\x18\x07 \x03(\tR\x18headersToUpstreamOnAllow\x12@\n\x1dheaders_to_downstream_on_deny\x18\x08 \x03(\tR\x19headersToDownstreamOnDeny\x1aR\n$IncludeAdditionalHeadersInCheckEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n\x05value\x18\x02 \x01(\tR\x05value:\x02\x38\x01\x1a\xec\x02\n&EnvoyExternalAuthorizationGrpcProvider\x12\x18\n\x07service\x18\x01 \x01(\tR\x07service\x12\x12\n\x04port\x18\x02 \x01(\rR\x04port\x12\x33\n\x07timeout\x18\x05 \x01(\x0b\x32\x19.google.protobuf.DurationR\x07timeout\x12\x1b\n\tfail_open\x18\x03 \x01(\x08R\x08\x66\x61ilOpen\x12&\n\x0fstatus_on_error\x18\x04 \x01(\tR\rstatusOnError\x12\x99\x01\n\x1dinclude_request_body_in_check\x18\x06 \x01(\x0b\x32W.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.EnvoyExternalAuthorizationRequestBodyR\x19includeRequestBodyInCheck\x1ak\n\x15ZipkinTracingProvider\x12\x18\n\x07service\x18\x01 \x01(\tR\x07service\x12\x12\n\x04port\x18\x02 \x01(\rR\x04port\x12$\n\x0emax_tag_length\x18\x03 \x01(\rR\x0cmaxTagLength\x1a\x91\x01\n\x18LightstepTracingProvider\x12\x18\n\x07service\x18\x01 \x01(\tR\x07service\x12\x12\n\x04port\x18\x02 \x01(\rR\x04port\x12!\n\x0c\x61\x63\x63\x65ss_token\x18\x03 \x01(\tR\x0b\x61\x63\x63\x65ssToken\x12$\n\x0emax_tag_length\x18\x04 \x01(\rR\x0cmaxTagLength\x1al\n\x16\x44\x61tadogTracingProvider\x12\x18\n\x07service\x18\x01 \x01(\tR\x07service\x12\x12\n\x04port\x18\x02 \x01(\rR\x04port\x12$\n\x0emax_tag_length\x18\x03 \x01(\rR\x0cmaxTagLength\x1al\n\x19SkyWalkingTracingProvider\x12\x18\n\x07service\x18\x01 \x01(\tR\x07service\x12\x12\n\x04port\x18\x02 \x01(\rR\x04port\x12!\n\x0c\x61\x63\x63\x65ss_token\x18\x03 \x01(\tR\x0b\x61\x63\x63\x65ssToken\x1a\xdc\x02\n\x13StackdriverProvider\x12\x14\n\x05\x64\x65\x62ug\x18\x01 \x01(\x08R\x05\x64\x65\x62ug\x12T\n\x18max_number_of_attributes\x18\x02 \x01(\x0b\x32\x1b.google.protobuf.Int64ValueR\x15maxNumberOfAttributes\x12V\n\x19max_number_of_annotations\x18\x03 \x01(\x0b\x32\x1b.google.protobuf.Int64ValueR\x16maxNumberOfAnnotations\x12[\n\x1cmax_number_of_message_events\x18\x04 \x01(\x0b\x32\x1b.google.protobuf.Int64ValueR\x18maxNumberOfMessageEvents\x12$\n\x0emax_tag_length\x18\x05 \x01(\rR\x0cmaxTagLength\x1a\xd4\x02\n\x1eOpenCensusAgentTracingProvider\x12\x18\n\x07service\x18\x01 \x01(\tR\x07service\x12\x12\n\x04port\x18\x02 \x01(\rR\x04port\x12w\n\x07\x63ontext\x18\x03 \x03(\x0e\x32].istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.OpenCensusAgentTracingProvider.TraceContextR\x07\x63ontext\x12$\n\x0emax_tag_length\x18\x04 \x01(\rR\x0cmaxTagLength\"e\n\x0cTraceContext\x12\x0f\n\x0bUNSPECIFIED\x10\x00\x12\x15\n\x11W3C_TRACE_CONTEXT\x10\x01\x12\x0c\n\x08GRPC_BIN\x10\x02\x12\x17\n\x13\x43LOUD_TRACE_CONTEXT\x10\x03\x12\x06\n\x02\x42\x33\x10\x04\x42\n\n\x08provider\x1a,\n\x10\x44\x65\x66\x61ultProviders\x12\x18\n\x07tracing\x18\x01 \x01(\tR\x07tracing\"J\n\x15IngressControllerMode\x12\x0f\n\x0bUNSPECIFIED\x10\x00\x12\x07\n\x03OFF\x10\x01\x12\x0b\n\x07\x44\x45\x46\x41ULT\x10\x02\x12\n\n\x06STRICT\x10\x03\"&\n\nAuthPolicy\x12\x08\n\x04NONE\x10\x00\x12\x0e\n\nMUTUAL_TLS\x10\x01\"\'\n\x11\x41\x63\x63\x65ssLogEncoding\x12\x08\n\x04TEXT\x10\x00\x12\x08\n\x04JSON\x10\x01\"2\n\x0fH2UpgradePolicy\x12\x12\n\x0e\x44O_NOT_UPGRADE\x10\x00\x12\x0b\n\x07UPGRADE\x10\x01J\x04\x08\x01\x10\x02J\x04\x08\x02\x10\x03J\x04\x08\x03\x10\x04J\x04\x08\x30\x10\x31J\x04\x08\x19\x10\x1aJ\x04\x08\x1e\x10\x1fJ\x04\x08\n\x10\x0bJ\x04\x08\x0b\x10\x0cJ\x04\x08\x0f\x10\x10J\x04\x08\x10\x10\x11J\x04\x08\x12\x10\x13J\x04\x08\x13\x10\x14J\x04\x08\x14\x10\x15J\x04\x08\x15\x10\x16J\x04\x08\x17\x10\x18J\x04\x08\x1d\x10\x1eJ\x04\x08\x35\x10\x36J\x04\x08%\x10&J\x04\x08&\x10\'J\x04\x08\'\x10(R\x12mixer_check_serverR\x13mixer_report_serverR\x15\x64isable_policy_checksR\x1a\x64isable_mixer_http_reportsR\x16policy_check_fail_openR%sidecar_to_telemetry_session_affinityR\x0b\x61uth_policyR\x11rds_refresh_delayR\rmixer_addressR\x1f\x65nable_client_side_policy_checkR\x0csds_uds_pathR\x11sds_refresh_delayR\x16\x65nable_sds_token_mountR\x12sds_use_k8s_sa_jwtR\x1atermination_drain_durationR\x14\x64isable_report_batchR\x18report_batch_max_entriesR\x15report_batch_max_time\"\xcb\x01\n\x0c\x43onfigSource\x12\x18\n\x07\x61\x64\x64ress\x18\x01 \x01(\tR\x07\x61\x64\x64ress\x12O\n\x0ctls_settings\x18\x02 \x01(\x0b\x32,.istio.networking.v1alpha3.ClientTLSSettingsR\x0btlsSettings\x12P\n\x14subscribed_resources\x18\x03 \x03(\x0e\x32\x1d.istio.mesh.v1alpha1.ResourceR\x13subscribedResources\"K\n\x0b\x43\x65rtificate\x12\x1f\n\x0bsecret_name\x18\x01 \x01(\tR\nsecretName\x12\x1b\n\tdns_names\x18\x02 \x03(\tR\x08\x64nsNames* \n\x08Resource\x12\x14\n\x10SERVICE_REGISTRY\x10\x00\x42\x1cZ\x1aistio.io/api/mesh/v1alpha1b\x06proto3')
   ,
   dependencies=[google_dot_protobuf_dot_duration__pb2.DESCRIPTOR,google_dot_protobuf_dot_wrappers__pb2.DESCRIPTOR,mesh_dot_v1alpha1_dot_proxy__pb2.DESCRIPTOR,networking_dot_v1alpha3_dot_destination__rule__pb2.DESCRIPTOR,k8s_dot_io_dot_apimachinery_dot_pkg_dot_apis_dot_meta_dot_v1_dot_generated__pb2.DESCRIPTOR,])
 
@@ -43,8 +43,8 @@
   ],
   containing_type=None,
   serialized_options=None,
-  serialized_start=8613,
-  serialized_end=8645,
+  serialized_start=8651,
+  serialized_end=8683,
 )
 _sym_db.RegisterEnumDescriptor(_RESOURCE)
 
@@ -103,8 +103,8 @@
   ],
   containing_type=None,
   serialized_options=None,
-  serialized_start=7429,
-  serialized_end=7530,
+  serialized_start=7467,
+  serialized_end=7568,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_EXTENSIONPROVIDER_OPENCENSUSAGENTTRACINGPROVIDER_TRACECONTEXT)
 
@@ -133,8 +133,8 @@
   ],
   containing_type=None,
   serialized_options=None,
-  serialized_start=7590,
-  serialized_end=7664,
+  serialized_start=7628,
+  serialized_end=7702,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_INGRESSCONTROLLERMODE)
 
@@ -155,8 +155,8 @@
   ],
   containing_type=None,
   serialized_options=None,
-  serialized_start=7666,
-  serialized_end=7704,
+  serialized_start=7704,
+  serialized_end=7742,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_AUTHPOLICY)
 
@@ -177,8 +177,8 @@
   ],
   containing_type=None,
   serialized_options=None,
-  serialized_start=7706,
-  serialized_end=7745,
+  serialized_start=7744,
+  serialized_end=7783,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_ACCESSLOGENCODING)
 
@@ -199,8 +199,8 @@
   ],
   containing_type=None,
   serialized_options=None,
-  serialized_start=7747,
-  serialized_end=7797,
+  serialized_start=7785,
+  serialized_end=7835,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_H2UPGRADEPOLICY)
 
@@ -257,6 +257,13 @@
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       serialized_options=None, json_name='spiffeBundleUrl', file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='trust_domains', full_name='istio.mesh.v1alpha1.MeshConfig.CertificateData.trust_domains', index=2,
+      number=3, type=9, cpp_type=9, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='trustDomains', file=DESCRIPTOR),
   ],
   extensions=[
   ],
@@ -272,8 +279,8 @@
       name='certificate_data', full_name='istio.mesh.v1alpha1.MeshConfig.CertificateData.certificate_data',
       index=0, containing_type=None, fields=[]),
   ],
-  serialized_start=3278,
-  serialized_end=3381,
+  serialized_start=3279,
+  serialized_end=3419,
 )
 
 _MESHCONFIG_THRIFTCONFIG = _descriptor.Descriptor(
@@ -309,8 +316,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=3383,
-  serialized_end=3508,
+  serialized_start=3421,
+  serialized_end=3546,
 )
 
 _MESHCONFIG_SERVICESETTINGS_SETTINGS = _descriptor.Descriptor(
@@ -339,8 +346,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=3638,
-  serialized_end=3685,
+  serialized_start=3676,
+  serialized_end=3723,
 )
 
 _MESHCONFIG_SERVICESETTINGS = _descriptor.Descriptor(
@@ -376,8 +383,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=3511,
-  serialized_end=3685,
+  serialized_start=3549,
+  serialized_end=3723,
 )
 
 _MESHCONFIG_CA = _descriptor.Descriptor(
@@ -427,8 +434,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=3688,
-  serialized_end=3900,
+  serialized_start=3726,
+  serialized_end=3938,
 )
 
 _MESHCONFIG_EXTENSIONPROVIDER_ENVOYEXTERNALAUTHORIZATIONREQUESTBODY = _descriptor.Descriptor(
@@ -471,8 +478,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=4872,
-  serialized_end=5043,
+  serialized_start=4910,
+  serialized_end=5081,
 )
 
 _MESHCONFIG_EXTENSIONPROVIDER_ENVOYEXTERNALAUTHORIZATIONHTTPPROVIDER_INCLUDEADDITIONALHEADERSINCHECKENTRY = _descriptor.Descriptor(
@@ -508,8 +515,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=5910,
-  serialized_end=5992,
+  serialized_start=5948,
+  serialized_end=6030,
 )
 
 _MESHCONFIG_EXTENSIONPROVIDER_ENVOYEXTERNALAUTHORIZATIONHTTPPROVIDER = _descriptor.Descriptor(
@@ -615,8 +622,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=5046,
-  serialized_end=5992,
+  serialized_start=5084,
+  serialized_end=6030,
 )
 
 _MESHCONFIG_EXTENSIONPROVIDER_ENVOYEXTERNALAUTHORIZATIONGRPCPROVIDER = _descriptor.Descriptor(
@@ -680,8 +687,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=5995,
-  serialized_end=6359,
+  serialized_start=6033,
+  serialized_end=6397,
 )
 
 _MESHCONFIG_EXTENSIONPROVIDER_ZIPKINTRACINGPROVIDER = _descriptor.Descriptor(
@@ -724,8 +731,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=6361,
-  serialized_end=6468,
+  serialized_start=6399,
+  serialized_end=6506,
 )
 
 _MESHCONFIG_EXTENSIONPROVIDER_LIGHTSTEPTRACINGPROVIDER = _descriptor.Descriptor(
@@ -775,8 +782,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=6471,
-  serialized_end=6616,
+  serialized_start=6509,
+  serialized_end=6654,
 )
 
 _MESHCONFIG_EXTENSIONPROVIDER_DATADOGTRACINGPROVIDER = _descriptor.Descriptor(
@@ -819,8 +826,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=6618,
-  serialized_end=6726,
+  serialized_start=6656,
+  serialized_end=6764,
 )
 
 _MESHCONFIG_EXTENSIONPROVIDER_SKYWALKINGTRACINGPROVIDER = _descriptor.Descriptor(
@@ -863,8 +870,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=6728,
-  serialized_end=6836,
+  serialized_start=6766,
+  serialized_end=6874,
 )
 
 _MESHCONFIG_EXTENSIONPROVIDER_STACKDRIVERPROVIDER = _descriptor.Descriptor(
@@ -921,8 +928,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=6839,
-  serialized_end=7187,
+  serialized_start=6877,
+  serialized_end=7225,
 )
 
 _MESHCONFIG_EXTENSIONPROVIDER_OPENCENSUSAGENTTRACINGPROVIDER = _descriptor.Descriptor(
@@ -973,8 +980,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=7190,
-  serialized_end=7530,
+  serialized_start=7228,
+  serialized_end=7568,
 )
 
 _MESHCONFIG_EXTENSIONPROVIDER = _descriptor.Descriptor(
@@ -1062,8 +1069,8 @@
       name='provider', full_name='istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.provider',
       index=0, containing_type=None, fields=[]),
   ],
-  serialized_start=3903,
-  serialized_end=7542,
+  serialized_start=3941,
+  serialized_end=7580,
 )
 
 _MESHCONFIG_DEFAULTPROVIDERS = _descriptor.Descriptor(
@@ -1092,8 +1099,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=7544,
-  serialized_end=7588,
+  serialized_start=7582,
+  serialized_end=7626,
 )
 
 _MESHCONFIG = _descriptor.Descriptor(
@@ -1400,7 +1407,7 @@
   oneofs=[
   ],
   serialized_start=241,
-  serialized_end=8328,
+  serialized_end=8366,
 )
 
 
@@ -1444,8 +1451,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=8331,
-  serialized_end=8534,
+  serialized_start=8369,
+  serialized_end=8572,
 )
 
 
@@ -1482,8 +1489,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=8536,
-  serialized_end=8611,
+  serialized_start=8574,
+  serialized_end=8649,
 )
 
 _MESHCONFIG_OUTBOUNDTRAFFICPOLICY.fields_by_name['mode'].enum_type = _MESHCONFIG_OUTBOUNDTRAFFICPOLICY_MODE
diff --git a/python/istio_api/security/v1beta1/authorization_policy_pb2.py b/python/istio_api/security/v1beta1/authorization_policy_pb2.py
index 5413e0f942d..99061fe3d05 100644
--- a/python/istio_api/security/v1beta1/authorization_policy_pb2.py
+++ b/python/istio_api/security/v1beta1/authorization_policy_pb2.py
@@ -22,7 +22,7 @@
   package='istio.security.v1beta1',
   syntax='proto3',
   serialized_options=_b('Z\035istio.io/api/security/v1beta1'),
-  serialized_pb=_b('\n+security/v1beta1/authorization_policy.proto\x12\x16istio.security.v1beta1\x1a\x1fgoogle/api/field_behavior.proto\x1a\x1btype/v1beta1/selector.proto\"\xa4\x03\n\x13\x41uthorizationPolicy\x12@\n\x08selector\x18\x01 \x01(\x0b\x32$.istio.type.v1beta1.WorkloadSelectorR\x08selector\x12\x32\n\x05rules\x18\x02 \x03(\x0b\x32\x1c.istio.security.v1beta1.RuleR\x05rules\x12J\n\x06\x61\x63tion\x18\x03 \x01(\x0e\x32\x32.istio.security.v1beta1.AuthorizationPolicy.ActionR\x06\x61\x63tion\x12[\n\x08provider\x18\x04 \x01(\x0b\x32=.istio.security.v1beta1.AuthorizationPolicy.ExtensionProviderH\x00R\x08provider\x1a\'\n\x11\x45xtensionProvider\x12\x12\n\x04name\x18\x01 \x01(\tR\x04name\"4\n\x06\x41\x63tion\x12\t\n\x05\x41LLOW\x10\x00\x12\x08\n\x04\x44\x45NY\x10\x01\x12\t\n\x05\x41UDIT\x10\x02\x12\n\n\x06\x43USTOM\x10\x03\x42\x0f\n\raction_detail\"\xac\x02\n\x04Rule\x12\x35\n\x04\x66rom\x18\x01 \x03(\x0b\x32!.istio.security.v1beta1.Rule.FromR\x04\x66rom\x12/\n\x02to\x18\x02 \x03(\x0b\x32\x1f.istio.security.v1beta1.Rule.ToR\x02to\x12\x35\n\x04when\x18\x03 \x03(\x0b\x32!.istio.security.v1beta1.ConditionR\x04when\x1a>\n\x04\x46rom\x12\x36\n\x06source\x18\x01 \x01(\x0b\x32\x1e.istio.security.v1beta1.SourceR\x06source\x1a\x45\n\x02To\x12?\n\toperation\x18\x01 \x01(\x0b\x32!.istio.security.v1beta1.OperationR\toperation\"\x97\x03\n\x06Source\x12\x1e\n\nprincipals\x18\x01 \x03(\tR\nprincipals\x12%\n\x0enot_principals\x18\x05 \x03(\tR\rnotPrincipals\x12-\n\x12request_principals\x18\x02 \x03(\tR\x11requestPrincipals\x12\x34\n\x16not_request_principals\x18\x06 \x03(\tR\x14notRequestPrincipals\x12\x1e\n\nnamespaces\x18\x03 \x03(\tR\nnamespaces\x12%\n\x0enot_namespaces\x18\x07 \x03(\tR\rnotNamespaces\x12\x1b\n\tip_blocks\x18\x04 \x03(\tR\x08ipBlocks\x12\"\n\rnot_ip_blocks\x18\x08 \x03(\tR\x0bnotIpBlocks\x12(\n\x10remote_ip_blocks\x18\t \x03(\tR\x0eremoteIpBlocks\x12/\n\x14not_remote_ip_blocks\x18\n \x03(\tR\x11notRemoteIpBlocks\"\xdf\x01\n\tOperation\x12\x14\n\x05hosts\x18\x01 \x03(\tR\x05hosts\x12\x1b\n\tnot_hosts\x18\x05 \x03(\tR\x08notHosts\x12\x14\n\x05ports\x18\x02 \x03(\tR\x05ports\x12\x1b\n\tnot_ports\x18\x06 \x03(\tR\x08notPorts\x12\x18\n\x07methods\x18\x03 \x03(\tR\x07methods\x12\x1f\n\x0bnot_methods\x18\x07 \x03(\tR\nnotMethods\x12\x14\n\x05paths\x18\x04 \x03(\tR\x05paths\x12\x1b\n\tnot_paths\x18\x08 \x03(\tR\x08notPaths\"Z\n\tCondition\x12\x16\n\x03key\x18\x01 \x01(\tB\x04\xe2\x41\x01\x02R\x03key\x12\x16\n\x06values\x18\x02 \x03(\tR\x06values\x12\x1d\n\nnot_values\x18\x03 \x03(\tR\tnotValuesB\x1fZ\x1distio.io/api/security/v1beta1b\x06proto3')
+  serialized_pb=_b('\n+security/v1beta1/authorization_policy.proto\x12\x16istio.security.v1beta1\x1a\x1fgoogle/api/field_behavior.proto\x1a\x1btype/v1beta1/selector.proto\"\xa4\x03\n\x13\x41uthorizationPolicy\x12@\n\x08selector\x18\x01 \x01(\x0b\x32$.istio.type.v1beta1.WorkloadSelectorR\x08selector\x12\x32\n\x05rules\x18\x02 \x03(\x0b\x32\x1c.istio.security.v1beta1.RuleR\x05rules\x12J\n\x06\x61\x63tion\x18\x03 \x01(\x0e\x32\x32.istio.security.v1beta1.AuthorizationPolicy.ActionR\x06\x61\x63tion\x12[\n\x08provider\x18\x04 \x01(\x0b\x32=.istio.security.v1beta1.AuthorizationPolicy.ExtensionProviderH\x00R\x08provider\x1a\'\n\x11\x45xtensionProvider\x12\x12\n\x04name\x18\x01 \x01(\tR\x04name\"4\n\x06\x41\x63tion\x12\t\n\x05\x41LLOW\x10\x00\x12\x08\n\x04\x44\x45NY\x10\x01\x12\t\n\x05\x41UDIT\x10\x02\x12\n\n\x06\x43USTOM\x10\x03\x42\x0f\n\raction_detail\"\xac\x02\n\x04Rule\x12\x35\n\x04\x66rom\x18\x01 \x03(\x0b\x32!.istio.security.v1beta1.Rule.FromR\x04\x66rom\x12/\n\x02to\x18\x02 \x03(\x0b\x32\x1f.istio.security.v1beta1.Rule.ToR\x02to\x12\x35\n\x04when\x18\x03 \x03(\x0b\x32!.istio.security.v1beta1.ConditionR\x04when\x1a>\n\x04\x46rom\x12\x36\n\x06source\x18\x01 \x01(\x0b\x32\x1e.istio.security.v1beta1.SourceR\x06source\x1a\x45\n\x02To\x12?\n\toperation\x18\x01 \x01(\x0b\x32!.istio.security.v1beta1.OperationR\toperation\"\xbc\x03\n\x06Source\x12\x1e\n\nprincipals\x18\x01 \x03(\tR\nprincipals\x12%\n\x0enot_principals\x18\x05 \x03(\tR\rnotPrincipals\x12-\n\x12request_principals\x18\x02 \x03(\tR\x11requestPrincipals\x12\x34\n\x16not_request_principals\x18\x06 \x03(\tR\x14notRequestPrincipals\x12\x1e\n\nnamespaces\x18\x03 \x03(\tR\nnamespaces\x12%\n\x0enot_namespaces\x18\x07 \x03(\tR\rnotNamespaces\x12\x1b\n\tip_blocks\x18\x04 \x03(\tR\x08ipBlocks\x12\"\n\rnot_ip_blocks\x18\x08 \x03(\tR\x0bnotIpBlocks\x12(\n\x10remote_ip_blocks\x18\t \x03(\tR\x0eremoteIpBlocks\x12/\n\x14not_remote_ip_blocks\x18\n \x03(\tR\x11notRemoteIpBlocks\x12#\n\rtrust_domains\x18\x0b \x03(\tR\x0ctrustDomains\"\xdf\x01\n\tOperation\x12\x14\n\x05hosts\x18\x01 \x03(\tR\x05hosts\x12\x1b\n\tnot_hosts\x18\x05 \x03(\tR\x08notHosts\x12\x14\n\x05ports\x18\x02 \x03(\tR\x05ports\x12\x1b\n\tnot_ports\x18\x06 \x03(\tR\x08notPorts\x12\x18\n\x07methods\x18\x03 \x03(\tR\x07methods\x12\x1f\n\x0bnot_methods\x18\x07 \x03(\tR\nnotMethods\x12\x14\n\x05paths\x18\x04 \x03(\tR\x05paths\x12\x1b\n\tnot_paths\x18\x08 \x03(\tR\x08notPaths\"Z\n\tCondition\x12\x16\n\x03key\x18\x01 \x01(\tB\x04\xe2\x41\x01\x02R\x03key\x12\x16\n\x06values\x18\x02 \x03(\tR\x06values\x12\x1d\n\nnot_values\x18\x03 \x03(\tR\tnotValuesB\x1fZ\x1distio.io/api/security/v1beta1b\x06proto3')
   ,
   dependencies=[google_dot_api_dot_field__behavior__pb2.DESCRIPTOR,type_dot_v1beta1_dot_selector__pb2.DESCRIPTOR,])
 
@@ -327,6 +327,13 @@
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       serialized_options=None, json_name='notRemoteIpBlocks', file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='trust_domains', full_name='istio.security.v1beta1.Source.trust_domains', index=10,
+      number=11, type=9, cpp_type=9, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='trustDomains', file=DESCRIPTOR),
   ],
   extensions=[
   ],
@@ -340,7 +347,7 @@
   oneofs=[
   ],
   serialized_start=860,
-  serialized_end=1267,
+  serialized_end=1304,
 )
 
 
@@ -419,8 +426,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1270,
-  serialized_end=1493,
+  serialized_start=1307,
+  serialized_end=1530,
 )
 
 
@@ -464,8 +471,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1495,
-  serialized_end=1585,
+  serialized_start=1532,
+  serialized_end=1622,
 )
 
 _AUTHORIZATIONPOLICY_EXTENSIONPROVIDER.containing_type = _AUTHORIZATIONPOLICY
diff --git a/security/v1beta1/authorization_policy.gen.json b/security/v1beta1/authorization_policy.gen.json
index 48b32a11c83..1c118f8a5db 100644
--- a/security/v1beta1/authorization_policy.gen.json
+++ b/security/v1beta1/authorization_policy.gen.json
@@ -228,6 +228,14 @@
               "type": "string",
               "format": "string"
             }
+          },
+          "trustDomains": {
+            "description": "Optional. A list of trust domains of peer certificates. If not specified, the default trust domain and its aliases will be used.",
+            "type": "array",
+            "items": {
+              "type": "string",
+              "format": "string"
+            }
           }
         }
       },
diff --git a/security/v1beta1/authorization_policy.pb.go b/security/v1beta1/authorization_policy.pb.go
index 20f674e0057..3618efd693c 100644
--- a/security/v1beta1/authorization_policy.pb.go
+++ b/security/v1beta1/authorization_policy.pb.go
@@ -685,7 +685,10 @@ type Source struct {
 	// If not set, any IP is allowed.
 	RemoteIpBlocks []string `protobuf:"bytes,9,rep,name=remote_ip_blocks,json=remoteIpBlocks,proto3" json:"remote_ip_blocks,omitempty"`
 	// Optional. A list of negative match of remote IP blocks.
-	NotRemoteIpBlocks    []string `protobuf:"bytes,10,rep,name=not_remote_ip_blocks,json=notRemoteIpBlocks,proto3" json:"not_remote_ip_blocks,omitempty"`
+	NotRemoteIpBlocks []string `protobuf:"bytes,10,rep,name=not_remote_ip_blocks,json=notRemoteIpBlocks,proto3" json:"not_remote_ip_blocks,omitempty"`
+	// Optional. A list of trust domains of peer certificates.
+	// If not specified, the default trust domain and its aliases will be used.
+	TrustDomains         []string `protobuf:"bytes,11,rep,name=trust_domains,json=trustDomains,proto3" json:"trust_domains,omitempty"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -794,6 +797,13 @@ func (m *Source) GetNotRemoteIpBlocks() []string {
 	return nil
 }
 
+func (m *Source) GetTrustDomains() []string {
+	if m != nil {
+		return m.TrustDomains
+	}
+	return nil
+}
+
 // Operation specifies the operations of a request. Fields in the operation are
 // ANDed together.
 //
@@ -1014,55 +1024,57 @@ func init() {
 }
 
 var fileDescriptor_438e25379256bb35 = []byte{
-	// 768 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x94, 0x95, 0xdd, 0x6e, 0xe3, 0x44,
-	0x14, 0xc7, 0xd7, 0x8e, 0xe3, 0xc6, 0xa7, 0xda, 0x92, 0x1d, 0xa2, 0x28, 0xca, 0xb2, 0x69, 0x89,
-	0x40, 0x44, 0x5a, 0xe1, 0x68, 0xc3, 0xc2, 0x1d, 0x1f, 0xc9, 0x6e, 0xd1, 0x16, 0xf5, 0x4b, 0x6e,
-	0x4a, 0x45, 0xb9, 0xb0, 0x1c, 0x67, 0xda, 0x8c, 0xea, 0xf8, 0x98, 0xf1, 0x24, 0x10, 0x5e, 0x84,
-	0x17, 0xe0, 0x92, 0x07, 0xe1, 0x92, 0x37, 0x00, 0xe5, 0x49, 0xd0, 0xcc, 0xd8, 0x8e, 0xe9, 0x97,
-	0xc4, 0x5d, 0xce, 0x9c, 0xdf, 0xff, 0x9c, 0x33, 0xff, 0x63, 0x3b, 0xf0, 0x32, 0xa5, 0xe1, 0x82,
-	0x33, 0xb1, 0xea, 0x2f, 0x5f, 0x4d, 0xa8, 0x08, 0x5e, 0xf5, 0x83, 0x85, 0x98, 0x21, 0x67, 0xbf,
-	0x06, 0x82, 0x61, 0xec, 0x27, 0x18, 0xb1, 0x70, 0xe5, 0x26, 0x1c, 0x05, 0x92, 0x26, 0x4b, 0x05,
-	0x43, 0x37, 0x97, 0xb8, 0x99, 0xa4, 0xbd, 0x7b, 0x8d, 0x78, 0x1d, 0xd1, 0x7e, 0x90, 0xb0, 0xfe,
-	0x15, 0xa3, 0xd1, 0xd4, 0x9f, 0xd0, 0x59, 0xb0, 0x64, 0xc8, 0xb5, 0xb0, 0xfd, 0x5c, 0xac, 0x12,
-	0x5a, 0x74, 0x48, 0x69, 0x44, 0x43, 0x91, 0x27, 0xbb, 0xbf, 0x57, 0xe0, 0xfd, 0x61, 0xb9, 0xe9,
-	0xa9, 0xea, 0x49, 0xbe, 0x81, 0x5a, 0x4e, 0xb6, 0x8c, 0x3d, 0xa3, 0xb7, 0x3d, 0xf8, 0xc8, 0xd5,
-	0x03, 0xc8, 0x6a, 0x79, 0x73, 0xf7, 0x02, 0xf9, 0x4d, 0x84, 0xc1, 0xf4, 0x2c, 0x63, 0xbd, 0x42,
-	0x45, 0x06, 0x50, 0xe5, 0x8b, 0x88, 0xa6, 0x2d, 0x73, 0xaf, 0xd2, 0xdb, 0x1e, 0x7c, 0xe0, 0xde,
-	0x3f, 0xbf, 0xeb, 0x2d, 0x22, 0xea, 0x69, 0x94, 0x7c, 0x07, 0x76, 0x10, 0xca, 0x29, 0x5a, 0x95,
-	0x3d, 0xa3, 0xb7, 0x33, 0x18, 0x3c, 0x24, 0xba, 0x67, 0x64, 0x77, 0xa8, 0x94, 0x5e, 0x56, 0x81,
-	0xfc, 0x08, 0xb5, 0x84, 0xe3, 0x92, 0x4d, 0x29, 0x6f, 0x59, 0xea, 0x06, 0x5f, 0xfe, 0x9f, 0x6a,
-	0xfb, 0xbf, 0x08, 0x1a, 0xa7, 0x32, 0xce, 0x8a, 0xbc, 0x7b, 0xe2, 0x15, 0x05, 0xdb, 0x9f, 0xc0,
-	0xb3, 0x3b, 0x00, 0x21, 0x60, 0xc5, 0xc1, 0x9c, 0x2a, 0xbf, 0x1c, 0x4f, 0xfd, 0xee, 0xbe, 0x06,
-	0x5b, 0xcf, 0x45, 0x1c, 0xa8, 0x0e, 0x0f, 0x0f, 0x4f, 0x2e, 0xea, 0x4f, 0x48, 0x0d, 0xac, 0xb7,
-	0xfb, 0xc7, 0x3f, 0xd4, 0x0d, 0x75, 0x78, 0xfe, 0xf6, 0x60, 0x5c, 0x37, 0x09, 0x80, 0xfd, 0xe6,
-	0xfc, 0x6c, 0x7c, 0x72, 0x54, 0xaf, 0x8c, 0xde, 0x83, 0xa7, 0xfa, 0x16, 0xfe, 0x94, 0x8a, 0x80,
-	0x45, 0xdd, 0x3f, 0x4c, 0xb0, 0xa4, 0x51, 0xe4, 0x73, 0xb0, 0xae, 0x38, 0xce, 0x5b, 0x86, 0x32,
-	0xf5, 0xc3, 0xc7, 0x4c, 0x75, 0xbf, 0xe5, 0x38, 0xf7, 0x14, 0x4e, 0xfa, 0x60, 0x0a, 0xcc, 0x36,
-	0xb1, 0xfb, 0xa8, 0x68, 0x8c, 0x9e, 0x29, 0x50, 0xf6, 0xf9, 0x79, 0x46, 0xe5, 0x1e, 0x1e, 0xed,
-	0xf3, 0x06, 0xe3, 0x29, 0x53, 0xb6, 0x2b, 0xbc, 0xfd, 0x15, 0x58, 0xb2, 0x2b, 0xf9, 0x02, 0xec,
-	0x14, 0x17, 0x3c, 0xa4, 0xd9, 0xc3, 0xd3, 0x79, 0xa8, 0xc0, 0x99, 0xa2, 0xbc, 0x8c, 0x6e, 0xef,
-	0x83, 0x39, 0x46, 0xf2, 0x35, 0x38, 0x98, 0x50, 0xae, 0xd6, 0x91, 0x15, 0x78, 0x70, 0x82, 0x93,
-	0x1c, 0xf4, 0x36, 0x9a, 0xee, 0x6f, 0x15, 0xb0, 0x75, 0x65, 0xd2, 0x01, 0x48, 0x38, 0x8b, 0x43,
-	0x96, 0x04, 0x51, 0xaa, 0x6c, 0x73, 0xbc, 0xd2, 0x09, 0xf9, 0x18, 0x76, 0x62, 0x14, 0x7e, 0x89,
-	0xa9, 0x2a, 0xe6, 0x69, 0x8c, 0xe2, 0x74, 0x83, 0x7d, 0x0a, 0x84, 0xd3, 0x9f, 0x16, 0x34, 0xfd,
-	0x0f, 0x6a, 0x2a, 0xf4, 0x59, 0x96, 0x29, 0xe1, 0xaf, 0xa1, 0x29, 0xab, 0xde, 0x23, 0xb1, 0x95,
-	0xa4, 0x11, 0xa3, 0xf0, 0xee, 0xa8, 0x3a, 0x00, 0xf2, 0xa1, 0x49, 0x93, 0x20, 0xa4, 0xa9, 0xb2,
-	0xde, 0xf1, 0x4a, 0x27, 0xf9, 0xac, 0x25, 0x66, 0xab, 0x98, 0xf5, 0x78, 0x83, 0x3d, 0x07, 0x87,
-	0x25, 0xfe, 0x24, 0xc2, 0xf0, 0x26, 0x6d, 0x59, 0x8a, 0xa8, 0xb1, 0x64, 0xa4, 0x62, 0xd2, 0x05,
-	0x49, 0xfb, 0x1b, 0xa0, 0xa6, 0x80, 0xed, 0x18, 0xc5, 0x41, 0xce, 0xf4, 0xa0, 0xce, 0xe9, 0x1c,
-	0x05, 0x2d, 0x61, 0x8e, 0xc2, 0x76, 0xf4, 0x79, 0x41, 0xf6, 0xa1, 0xa1, 0xef, 0x79, 0x8b, 0x06,
-	0x6d, 0x8c, 0xba, 0x65, 0x59, 0xd0, 0xfd, 0xdb, 0x00, 0xa7, 0x58, 0x19, 0x69, 0x40, 0x75, 0x86,
-	0xa9, 0xc8, 0xf7, 0xa2, 0x03, 0x39, 0xbf, 0x2c, 0xaa, 0x33, 0x7a, 0x1b, 0xb5, 0x18, 0xc5, 0x3b,
-	0x95, 0x6c, 0x40, 0x35, 0x41, 0x2e, 0x72, 0xef, 0x75, 0x90, 0x4b, 0x74, 0xc6, 0x2e, 0x24, 0xa7,
-	0x2a, 0xd9, 0x82, 0xad, 0x39, 0x15, 0x33, 0x9c, 0xe6, 0x9e, 0xe6, 0x21, 0xd9, 0x05, 0x79, 0x6f,
-	0x3f, 0xcf, 0x6e, 0x65, 0x8e, 0xa3, 0x38, 0xca, 0x00, 0xd9, 0x2d, 0x10, 0xb3, 0xdc, 0x46, 0x1d,
-	0x14, 0xdd, 0x54, 0xa6, 0xb6, 0xe9, 0x26, 0xe3, 0xee, 0x25, 0x38, 0xc5, 0x5b, 0x41, 0x9a, 0x50,
-	0xb9, 0xa1, 0x2b, 0xfd, 0x45, 0x18, 0x59, 0xeb, 0xa1, 0x61, 0x7a, 0xf2, 0x80, 0x34, 0xc1, 0x5e,
-	0x06, 0xd1, 0x82, 0xe6, 0xd7, 0xc8, 0x22, 0xf2, 0x02, 0x64, 0x77, 0x3f, 0xcb, 0xe9, 0x69, 0x65,
-	0xaf, 0xef, 0xd5, 0xc1, 0xe8, 0xe5, 0x9f, 0xeb, 0x8e, 0xf1, 0xd7, 0xba, 0x63, 0xfc, 0xb3, 0xee,
-	0x18, 0x97, 0x2f, 0xf4, 0x2b, 0xc1, 0x50, 0x7d, 0xfb, 0x6f, 0xff, 0x97, 0x4c, 0x6c, 0xf5, 0x85,
-	0xff, 0xec, 0xdf, 0x00, 0x00, 0x00, 0xff, 0xff, 0xe2, 0xda, 0xc0, 0xc7, 0x66, 0x06, 0x00, 0x00,
+	// 788 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x94, 0x95, 0xdd, 0x8e, 0xdb, 0x44,
+	0x14, 0xc7, 0x6b, 0xc7, 0xf1, 0xc6, 0x27, 0xec, 0x92, 0x0e, 0x51, 0x64, 0xa5, 0x34, 0xbb, 0x04,
+	0x10, 0x91, 0x2a, 0x1c, 0x35, 0x14, 0xee, 0xf8, 0x48, 0xba, 0x8b, 0x5a, 0xd4, 0x76, 0x57, 0xde,
+	0x94, 0x8a, 0x72, 0x61, 0x39, 0xce, 0xb4, 0x19, 0xad, 0xe3, 0x63, 0xc6, 0xe3, 0x40, 0x78, 0x1e,
+	0x2e, 0x79, 0x04, 0x1e, 0x80, 0x4b, 0xde, 0x00, 0x94, 0x27, 0x41, 0x33, 0x63, 0x3b, 0x69, 0xf7,
+	0x43, 0xea, 0x5d, 0xce, 0x39, 0xbf, 0xff, 0xf9, 0xb4, 0x63, 0xb8, 0x97, 0xd1, 0x28, 0xe7, 0x4c,
+	0xac, 0x87, 0xab, 0xfb, 0x33, 0x2a, 0xc2, 0xfb, 0xc3, 0x30, 0x17, 0x0b, 0xe4, 0xec, 0xf7, 0x50,
+	0x30, 0x4c, 0x82, 0x14, 0x63, 0x16, 0xad, 0xbd, 0x94, 0xa3, 0x40, 0xd2, 0x61, 0x99, 0x60, 0xe8,
+	0x95, 0x12, 0xaf, 0x90, 0x74, 0x0f, 0x5f, 0x23, 0xbe, 0x8e, 0xe9, 0x30, 0x4c, 0xd9, 0xf0, 0x15,
+	0xa3, 0xf1, 0x3c, 0x98, 0xd1, 0x45, 0xb8, 0x62, 0xc8, 0xb5, 0xb0, 0x7b, 0x47, 0xac, 0x53, 0x5a,
+	0x55, 0xc8, 0x68, 0x4c, 0x23, 0x51, 0x06, 0xfb, 0x7f, 0xd4, 0xe0, 0x83, 0xf1, 0x6e, 0xd1, 0x33,
+	0x55, 0x93, 0x7c, 0x07, 0x8d, 0x92, 0x74, 0x8d, 0x23, 0x63, 0xd0, 0x1c, 0x7d, 0xe2, 0xe9, 0x06,
+	0x64, 0xb6, 0xb2, 0xb8, 0xf7, 0x02, 0xf9, 0x45, 0x8c, 0xe1, 0xfc, 0xbc, 0x60, 0xfd, 0x4a, 0x45,
+	0x46, 0x50, 0xe7, 0x79, 0x4c, 0x33, 0xd7, 0x3c, 0xaa, 0x0d, 0x9a, 0xa3, 0x0f, 0xbd, 0xab, 0xfb,
+	0xf7, 0xfc, 0x3c, 0xa6, 0xbe, 0x46, 0xc9, 0x0f, 0x60, 0x87, 0x91, 0xec, 0xc2, 0xad, 0x1d, 0x19,
+	0x83, 0x83, 0xd1, 0xe8, 0x3a, 0xd1, 0x15, 0x2d, 0x7b, 0x63, 0xa5, 0xf4, 0x8b, 0x0c, 0xe4, 0x67,
+	0x68, 0xa4, 0x1c, 0x57, 0x6c, 0x4e, 0xb9, 0x6b, 0xa9, 0x09, 0xbe, 0x7e, 0x97, 0x6c, 0x27, 0xbf,
+	0x09, 0x9a, 0x64, 0xd2, 0x2e, 0x92, 0x3c, 0xba, 0xe5, 0x57, 0x09, 0xbb, 0x9f, 0xc1, 0xed, 0x4b,
+	0x00, 0x21, 0x60, 0x25, 0xe1, 0x92, 0xaa, 0x7d, 0x39, 0xbe, 0xfa, 0xdd, 0x7f, 0x00, 0xb6, 0xee,
+	0x8b, 0x38, 0x50, 0x1f, 0x3f, 0x79, 0x72, 0xfa, 0xa2, 0x75, 0x8b, 0x34, 0xc0, 0x3a, 0x3e, 0x79,
+	0xf6, 0x53, 0xcb, 0x50, 0xce, 0xe7, 0xc7, 0x8f, 0xa7, 0x2d, 0x93, 0x00, 0xd8, 0x0f, 0x9f, 0x9f,
+	0x4f, 0x4f, 0x9f, 0xb6, 0x6a, 0x93, 0xf7, 0x61, 0x5f, 0x4f, 0x11, 0xcc, 0xa9, 0x08, 0x59, 0xdc,
+	0xff, 0xd3, 0x04, 0x4b, 0x2e, 0x8a, 0x7c, 0x09, 0xd6, 0x2b, 0x8e, 0x4b, 0xd7, 0x50, 0x4b, 0xfd,
+	0xe8, 0xa6, 0xa5, 0x7a, 0xdf, 0x73, 0x5c, 0xfa, 0x0a, 0x27, 0x43, 0x30, 0x05, 0x16, 0x97, 0x38,
+	0xbc, 0x51, 0x34, 0x45, 0xdf, 0x14, 0x28, 0xeb, 0xfc, 0xba, 0xa0, 0xf2, 0x0e, 0x37, 0xd6, 0x79,
+	0x88, 0xc9, 0x9c, 0xa9, 0xb5, 0x2b, 0xbc, 0xfb, 0x0d, 0x58, 0xb2, 0x2a, 0xf9, 0x0a, 0xec, 0x0c,
+	0x73, 0x1e, 0xd1, 0xe2, 0xe1, 0xe9, 0x5d, 0x97, 0xe0, 0x5c, 0x51, 0x7e, 0x41, 0x77, 0x4f, 0xc0,
+	0x9c, 0x22, 0xf9, 0x16, 0x1c, 0x4c, 0x29, 0x57, 0xe7, 0x28, 0x12, 0x5c, 0xdb, 0xc1, 0x69, 0x09,
+	0xfa, 0x5b, 0x4d, 0xff, 0xaf, 0x1a, 0xd8, 0x3a, 0x33, 0xe9, 0x01, 0xa4, 0x9c, 0x25, 0x11, 0x4b,
+	0xc3, 0x38, 0x53, 0x6b, 0x73, 0xfc, 0x1d, 0x0f, 0xf9, 0x14, 0x0e, 0x12, 0x14, 0xc1, 0x0e, 0x53,
+	0x57, 0xcc, 0x7e, 0x82, 0xe2, 0x6c, 0x8b, 0x7d, 0x0e, 0x84, 0xd3, 0x5f, 0x72, 0x9a, 0xbd, 0x81,
+	0x9a, 0x0a, 0xbd, 0x5d, 0x44, 0x76, 0xf0, 0x07, 0xd0, 0x91, 0x59, 0xaf, 0x90, 0xd8, 0x4a, 0xd2,
+	0x4e, 0x50, 0xf8, 0x97, 0x54, 0x3d, 0x00, 0xf9, 0xd0, 0x64, 0x69, 0x18, 0xd1, 0x4c, 0xad, 0xde,
+	0xf1, 0x77, 0x3c, 0x65, 0xaf, 0x3b, 0xcc, 0x5e, 0xd5, 0xeb, 0xb3, 0x2d, 0x76, 0x07, 0x1c, 0x96,
+	0x06, 0xb3, 0x18, 0xa3, 0x8b, 0xcc, 0xb5, 0x14, 0xd1, 0x60, 0xe9, 0x44, 0xd9, 0xa4, 0x0f, 0x92,
+	0x0e, 0xb6, 0x40, 0x43, 0x01, 0xcd, 0x04, 0xc5, 0xe3, 0x92, 0x19, 0x40, 0x8b, 0xd3, 0x25, 0x0a,
+	0xba, 0x83, 0x39, 0x0a, 0x3b, 0xd0, 0xfe, 0x8a, 0x1c, 0x42, 0x5b, 0xcf, 0xf9, 0x16, 0x0d, 0x7a,
+	0x31, 0x6a, 0xca, 0x37, 0x04, 0x1f, 0xc3, 0xbe, 0xe0, 0x79, 0x26, 0x82, 0x39, 0x2e, 0x43, 0x96,
+	0x64, 0x6e, 0x53, 0x91, 0xef, 0x29, 0xe7, 0xb1, 0xf6, 0xf5, 0xff, 0x35, 0xc0, 0xa9, 0xee, 0x4a,
+	0xda, 0x50, 0x5f, 0x60, 0x26, 0xca, 0xe3, 0x69, 0x43, 0x0e, 0x29, 0x2b, 0xeb, 0x88, 0x3e, 0x59,
+	0x23, 0x41, 0xf1, 0x48, 0x05, 0xdb, 0x50, 0x4f, 0x91, 0x8b, 0xf2, 0x40, 0xda, 0x28, 0x25, 0x3a,
+	0x62, 0x57, 0x92, 0x33, 0x15, 0x74, 0x61, 0x6f, 0x49, 0xc5, 0x02, 0xe7, 0xe5, 0xe2, 0x4b, 0x93,
+	0x1c, 0x82, 0x5c, 0x4e, 0x50, 0x46, 0xf7, 0x8a, 0xb3, 0xa0, 0x78, 0x5a, 0x00, 0xb2, 0x5a, 0x28,
+	0x16, 0xe5, 0xae, 0xb5, 0x51, 0x55, 0x53, 0x91, 0xc6, 0xb6, 0x9a, 0xb4, 0xfb, 0x2f, 0xc1, 0xa9,
+	0x5e, 0x1d, 0xd2, 0x81, 0xda, 0x05, 0x5d, 0xeb, 0xbf, 0x8d, 0x89, 0xb5, 0x19, 0x1b, 0xa6, 0x2f,
+	0x1d, 0xa4, 0x03, 0xf6, 0x2a, 0x8c, 0x73, 0x5a, 0x8e, 0x51, 0x58, 0xe4, 0x2e, 0xc8, 0xea, 0x41,
+	0x11, 0xd3, 0xdd, 0xca, 0x5a, 0x3f, 0x2a, 0xc7, 0xe4, 0xde, 0xdf, 0x9b, 0x9e, 0xf1, 0xcf, 0xa6,
+	0x67, 0xfc, 0xb7, 0xe9, 0x19, 0x2f, 0xef, 0xea, 0xf7, 0x86, 0xa1, 0xfa, 0x40, 0xbc, 0xfd, 0xc1,
+	0x99, 0xd9, 0xea, 0x33, 0xf0, 0xc5, 0xff, 0x01, 0x00, 0x00, 0xff, 0xff, 0x5d, 0x1f, 0xa5, 0x66,
+	0x8b, 0x06, 0x00, 0x00,
 }
 
 func (m *AuthorizationPolicy) Marshal() (dAtA []byte, err error) {
@@ -1358,6 +1370,15 @@ func (m *Source) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.TrustDomains) > 0 {
+		for iNdEx := len(m.TrustDomains) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.TrustDomains[iNdEx])
+			copy(dAtA[i:], m.TrustDomains[iNdEx])
+			i = encodeVarintAuthorizationPolicy(dAtA, i, uint64(len(m.TrustDomains[iNdEx])))
+			i--
+			dAtA[i] = 0x5a
+		}
+	}
 	if len(m.NotRemoteIpBlocks) > 0 {
 		for iNdEx := len(m.NotRemoteIpBlocks) - 1; iNdEx >= 0; iNdEx-- {
 			i -= len(m.NotRemoteIpBlocks[iNdEx])
@@ -1797,6 +1818,12 @@ func (m *Source) Size() (n int) {
 			n += 1 + l + sovAuthorizationPolicy(uint64(l))
 		}
 	}
+	if len(m.TrustDomains) > 0 {
+		for _, s := range m.TrustDomains {
+			l = len(s)
+			n += 1 + l + sovAuthorizationPolicy(uint64(l))
+		}
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -2831,6 +2858,38 @@ func (m *Source) Unmarshal(dAtA []byte) error {
 			}
 			m.NotRemoteIpBlocks = append(m.NotRemoteIpBlocks, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
+		case 11:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TrustDomains", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAuthorizationPolicy
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAuthorizationPolicy
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAuthorizationPolicy
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.TrustDomains = append(m.TrustDomains, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipAuthorizationPolicy(dAtA[iNdEx:])
diff --git a/security/v1beta1/authorization_policy.pb.html b/security/v1beta1/authorization_policy.pb.html
index bd4a49a112d..f64477798b4 100644
--- a/security/v1beta1/authorization_policy.pb.html
+++ b/security/v1beta1/authorization_policy.pb.html
@@ -477,6 +477,18 @@ <h2 id="Source">Source</h2>
 <td>
 <p>Optional. A list of negative match of remote IP blocks.</p>
 
+</td>
+<td>
+No
+</td>
+</tr>
+<tr id="Source-trust_domains">
+<td><code>trustDomains</code></td>
+<td><code>string[]</code></td>
+<td>
+<p>Optional. A list of trust domains of peer certificates.
+If not specified, the default trust domain and its aliases will be used.</p>
+
 </td>
 <td>
 No
diff --git a/security/v1beta1/authorization_policy.proto b/security/v1beta1/authorization_policy.proto
index 4f879dd0d46..0845172383d 100644
--- a/security/v1beta1/authorization_policy.proto
+++ b/security/v1beta1/authorization_policy.proto
@@ -410,6 +410,10 @@ message Source {
 
   // Optional. A list of negative match of remote IP blocks.
   repeated string not_remote_ip_blocks = 10;
+
+  // Optional. A list of trust domains of peer certificates.
+  // If not specified, the default trust domain and its aliases will be used.
+  repeated string trust_domains = 11;
 }
 
 // Operation specifies the operations of a request. Fields in the operation are