- apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
    verbs: ["update"]
    # TODO: should be on just */status but wildcard is not supported
    resources: ["*"]

  # Needed because status reporter sets the config map owner reference to the istiod pod
  - apiGroups: [""]
    verbs: ["update"]

  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
    verbs: ["update"]
    # TODO: should be on just */status but wildcard is not supported
    resources: ["*"]

  # Needed because status reporter sets the config map owner reference to the istiod pod
  - apiGroups: [""]
    verbs: ["update"]

- apiGroups: ["networking.istio.io"]
  verbs: ["create"]
  resources: ["gateways"]

# For storing CA secret
- apiGroups: [""]
  resources: ["secrets"]
  # TODO lock this down to istio-ca-cert if not using the DNS cert mesh config
  verbs: ["create", "get", "watch", "list", "update", "delete"]

# For status controller, so it can delete the distribution report configmap
- apiGroups: [""]

environment variable `ISTIO_CLUSTER_ISGKE` is assumed to be set to `true` if the cluster is a GKE cluster. ```bash ISTIO_CNI_ARGS= # TODO: What k8s data can we use for this check for whether GKE? if [[ "${ISTIO_CLUSTER_ISGKE}" == "true" ]]; then ISTIO_CNI_ARGS="--set cni.cniBinDir=/home/kubernetes/bin" fi iop kube-system istio-cni $IBASE/istio-cni/ ${ISTIO_CNI_ARGS} ``` TODO. It is possible to add Istio-CNI later, and gradually migrate. ### Install Control plane This can run in any cluster. A mesh should...

      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
      # and doesn't spam the readiness endpoint too much
      #
      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.

    clusterName: ""

  # meshConfig defines runtime configuration of components.
  # For ztunnel, only defaultConfig is used, but this is nested under `meshConfig` for consistency with other
  # components.
  # TODO: https://github.com/istio/istio/issues/43248
  meshConfig:
    defaultConfig:
      proxyMetadata: {}

  # This value defines:

- apiGroups: ["networking.istio.io"]
  verbs: ["create"]
  resources: ["gateways"]

# For storing CA secret
- apiGroups: [""]
  resources: ["secrets"]
  # TODO lock this down to istio-ca-cert if not using the DNS cert mesh config
  verbs: ["create", "get", "watch", "list", "update", "delete"]

# For status controller, so it can delete the distribution report configmap
- apiGroups: [""]

      configVolumes: []
      additionalContainers: []

      serviceAccount:
        # Annotations to add to the service account
        annotations: {}

      ### Advanced options ############
      # TODO: convert to real options, env should not be exposed
      env: {}
        # Set this to "external" if and only if you want the egress gateway to
        # act as a transparent SNI gateway that routes mTLS/TLS traffic to