prove
    pilot:
      k8s:
        env:
          # Indicate to Istiod that we use an external signer
          - name: EXTERNAL_CA
            value: ISTIOD_RA_KUBERNETES_API
          # Indicate to Istiod the external k8s Signer Name
          - name: K8S_SIGNER
            value: example.com/foo
        overlays:
        - kind: Deployment
          name: istiod
          patches:
            - path: spec.template.spec.containers[0].volumeMounts[-1]
              value: |
                # Mount externa