--certificate-oidc-issuer=https://accounts.google.com --certificate-identity=trustee@tetrate-istio-subscription.iam.gserviceaccount.com