wise, if a <code>ca.istio.io/env: &quot;ns-foo&quot;</code> label is defined in the service account&rsquo;s namespace, the Citadel instance in namespace <code>ns-foo</code> will be used for generating key/cert secrets for workloads in the <code>ServiceAccount</code>&rsquo;s namespace.</p></li><li><p>Otherwise, set <code>enableNamespacesByDefault</code> to <code>true</code> during installation. If it is <code>true</code>, the default Citadel instance will be used for generating key/cert secrets for workloads