resources:
  - "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret"
    name: cp_ca
    validation_context:
      # TLS certificate data containing CA certificates to verify downstream CP components certificate for mTLS authentication
      trusted_ca:
        filename: {{.DataPlaneCaCertFile}}
#      This section is optional and can be used to verify that the SAN of the client certificate matches the expected
#      value. The SAN can be DNS, EMAIL, URI or IP_ADDRESS. It is usually used in conjunction with mTLS authentcation
#      match_typed_subject_alt_names:
#      - san_type: DNS
#        matcher:
#          exact: client3.confluent.io
