</td></tr><tr><td><code>--upstream-ca-address &lt;string&gt;</code></td><td>The IP:port address of the upstream CA. When set, the CA will rely on the upstream Istio CA to provision its own certificate. (default ``)</td></tr><tr><td><code>--upstream-ca-cert-file &lt;string&gt;</code></td><td>Path to the certificate for authenticating upstream CA. (default ``)</td></tr><tr><td><code>--workload-cert-grace-period-ratio &lt;float32&gt;</code></td><td>The workload certificate rotation grace period, as a ratio of 