code: func WithMetadataForwardTLSInfo(ctx context.Context) (context.Context, error) {
  	md, ok := metadata.FromIncomingContext(ctx)
  	if !ok {
  		md = metadata.MD{}
  	}
  
  	ous := []string{}
  	org := ""
  	cn := ""
  
  	certSubj, err := certSubjectFromContext(ctx)
  	if err == nil {
  		cn = certSubj.CommonName
  		ous = certSubj.OrganizationalUnit
  		if len(certSubj.Organization) > 0 {
  			org = certSubj.Organization[0]
  		}
  	}
  
  	// If there's no TLS cert, forward with blank TLS metadata.
  	// Note that the presence of this blank metadata is extremely
  	// important. Without it, it would look like manager is making
  	// the request directly.
  	md[certForwardedKey] = []string{"true"}
  	md[certCNKey] = []string{cn}
  	md[certOrgKey] = []string{org}
  	md[certOUKey] = ous
  	peer, ok := peer.FromContext(ctx)
  	if ok {
  		md[remoteAddrKey] = []string{peer.Addr.String()}
  	}
  
  	return metadata.NewOutgoingContext(ctx, md), nil
  }
docs: // WithMetadataForwardTLSInfo reads certificate from context and returns context where
  // ForwardCert is set based on original certificate.