erver mounts the key and certificate pair according to the service account using <a href="https://kubernetes.io/docs/concepts/configuration/secret/">Kubernetes secrets</a>.</p></li><li><p><a href="/v0.7/docs/concepts/traffic-management/pilot.html">Pilot</a> generates the config with proper key and certificate and secure naming information, which defines what service account(s) can run a certain service, and passes it to Envoy.</p></li></ol><h3 id="deployment-phase-vmbare-metal-machines-scenario">Deployment 