// Istiod is running on the external cluster. Use the inCluster credentials to
	// create a kubeclientset
	if features.LocalClusterSecretWatcher && features.ExternalIstiod {
		config, err := kube.InClusterConfig(configOverrides...)
		if err != nil {
			log.Errorf("Could not get istiod incluster configuration: %v", err)
			return nil
		}

	IntegrationTestExternalIstiodPrimaryDefaultsIOP = "tests/integration/iop-externalistiod-primary-integration-test-defaults.yaml"

	// IntegrationTestExternalIstiodConfigDefaultsIOP is the path of the default IstioOperator spec to use
	// on external istiod config clusters for integration tests
	IntegrationTestExternalIstiodConfigDefaultsIOP = "tests/integration/iop-externalistiod-config-integration-test-defaults.yaml"

func (m *Multicluster) checkShouldLead(client kubelib.Client, systemNamespace string, stop <-chan struct{}) bool {
	var res bool
	if features.ExternalIstiod {
		b := backoff.NewExponentialBackOff(backoff.DefaultOption())
		ctx, cancel := context.WithCancel(context.Background())
		go func() {
			select {
			case <-stop:
				cancel()
			case <-ctx.Done():

	ClusterName = env.Register("CLUSTER_ID", constants.DefaultClusterName,
		"Defines the cluster and service registry that this Istiod instance belongs to").Get()

	ExternalIstiod = env.Register("EXTERNAL_ISTIOD", false,
		"If this is set to true, one Istiod will control remote clusters including CA.").Get()

	EnableCAServer = env.Register("ENABLE_CA_SERVER", true,

		{"Values.global.centralIstiod", "Values.global.externalIstiod", false},
		{"Values.global.arch", "the affinity of k8s settings", nil},
	}

	failHardSettings := []deprecatedSettings{
		{"Values.grafana.enabled", "the samples/addons/ deployments", false},

    caAddress: ""
    # Configure a remote cluster data plane controlled by an external istiod.
    # When set to true, istiod is not deployed locally and only a subset of the other
    # discovery charts are enabled.
    externalIstiod: true
    # Configure a remote cluster as the config cluster for an external istiod.
    configCluster: false
    # configValidation enables the validation webhook for Istio configuration.
    configValidation: true

    # Configure a remote cluster data plane controlled by an external istiod.
    # When set to true, istiod is not deployed locally and only a subset of the other
    # discovery charts are enabled.
    externalIstiod: false

    # Configure a remote cluster as the config cluster for an external istiod.
    configCluster: false

    # configValidation enables the validation webhook for Istio configuration.

	# copy istio-discovery values, but apply some local customizations
	cp manifests/charts/istio-control/istio-discovery/values.yaml manifests/charts/istiod-remote/
	yq -i '.defaults.telemetry.enabled=false | .defaults.global.externalIstiod=true | .defaults.global.omitSidecarInjectorConfigMap=true | .defaults.pilot.configMap=false' manifests/charts/istiod-remote/values.yaml
	warning=$$(cat manifests/helm-profiles/warning-edit.txt | sed ':a;N;$$!ba;s/\n/\\n/g') ; \

	if i.ctx.Environment().IsMultiCluster() {
		if i.externalControlPlane || i.cfg.IstiodlessRemotes {
			// Enable namespace controller writing to remote clusters
			args.AppendSet("values.pilot.env.EXTERNAL_ISTIOD", "true")
		}

		// Set the clusterName for the local cluster.
		// This MUST match the clusterName in the remote secret for this cluster.
		clusterName := c.Name()
		if !c.IsConfig() {