- `istio-cni-config` configmap with CNI plugin config to add to CNI plugin chained config
    - creates service-account `istio-cni` with `ClusterRoleBinding` to allow gets on pods' info and delete/modifications for recovery.

- `install-cni` container
    - copies `istio-cni` and `istio-iptables` to `/opt/cni/bin`
    - creates kubeconfig for the service account the pod runs under

        * Is the default behavior altered?
        * Is this turned on by default?
        * How many users are affected by this change?

## Feature implementation

Release managers will continue to have a final say in what gets merged or not, unless directed by the TOC. See the next
section if the implementation is done, but a bug is being addressed.

by a different role than the prod version.

The intended users of this repo are users running Istio in production who want to select, tune
and understand each binary that gets deployed, and select which combination to use.

Note: each component can be installed in parallel with an existing Istio 1.0 or 1.1 installation in

  //
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // The specification for the PersistentVolumeClaim. The entire content is
  // copied unchanged into the PVC that gets created from this
  // template. The same fields as in a PersistentVolumeClaim
  // are also valid here.
  optional PersistentVolumeClaimSpec spec = 2;
}

   while also keeping file watchers on them. Envoy proxy then connects to istio-agent's SDS Server through the defined socket path and gets the cryptographic materials of the certificate files served by the SDS API.