Citadel instance notices that a <code>ServiceAccount</code> is created in a namespace, it must decide whether
it should generate an <code>istio.io/key-and-cert</code> secret for that <code>ServiceAccount</code>.
In order to make that decision, Citadel considers three inputs (note: there can be multiple Citadel instances
deployed in a single cluster, and the following targeting rules are applied to each instance):</p><ol><li><p><code>ca.istio.io/env</code> namespace label: <em>string valued</em> label contai