- `istio-cni-config` configmap with CNI plugin config to add to CNI plugin chained config
    - creates service-account `istio-cni` with `ClusterRoleBinding` to allow gets on pods' info and delete/modifications for recovery.

- `install-cni` container
    - copies `istio-cni` and `istio-iptables` to `/opt/cni/bin`
    - creates kubeconfig for the service account the pod runs under

		},
	}

	cmd.PersistentFlags().BoolVarP(&skipConfirmation, "skip-confirmation", "y", false, skipConfirmationFlagHelpStr)
	return cmd
}

// setTag creates or modifies a revision tag.
func setTag(ctx context.Context, kubeClient kube.CLIClient, tagName, revision, istioNS string, generate bool, w, stderr io.Writer) error {
	opts := &GenerateOptions{
		Tag:                  tagName,

  //
  // The v1.22+ in-tree implementations of the well-known Kubernetes signers will
  // honor this field as long as the requested duration is not greater than the
  // maximum duration they will honor per the --cluster-signing-duration CLI
  // flag to the Kubernetes controller manager.
  //
  // Certificate signers may not honor this field for various reasons:
  //

	return s, nil
}

func (s *Server) Ready() {
	s.isReady.Store(true)
}

func (s *Server) NotReady() {
	s.isReady.Store(false)
}

// buildKubeClient creates the kube client
func buildKubeClient(kubeConfig string) (kube.Client, error) {
	// Used by validation
	kubeRestConfig, err := kube.DefaultRestConfig(kubeConfig, "", func(config *rest.Config) {
		config.QPS = 80

kubectl create namespace istio-system
```

Istio's helm charts come with a common `openshift` profile that can be used during installation.

The installation process using the Helm charts is as follows:

1) `base` chart creates cluster-wide CRDs, cluster bindings and cluster resources. It is possible to change the namespace from `istio-system` but it is not recommended.

```console

		helmreconciler.TestMode = true
		// Add install and controller to the list of commands to run tests against.
		testedManifestCmds = append(testedManifestCmds, cmdApply, cmdController)
	}
}

// recreateTestEnv (re)creates a kubebuilder fake API server environment. This is required for testing of the
// controller runtime, which is used in the operator.
func recreateTestEnv() error {

			_, _ = fmt.Fprintf(writer, "%q has warnings: %v\n", fname, warningToString(w))
		} else {
			_, _ = fmt.Fprintf(writer, "%q is valid\n", fname)
		}
	}

	return nil
}

// NewValidateCommand creates a new command for validating Istio k8s resources.
func NewValidateCommand(ctx cli.Context) *cobra.Command {
	var filenames []string
	var referential bool

	c := &cobra.Command{

  //
  // BorrowingCL(i) = round( NominalCL(i) * borrowingLimitPercent(i)/100.0 )
  //
  // The value of this field can be more than 100, implying that this
  // priority level can borrow a number of seats that is greater than
  // its own nominal concurrency limit (NominalCL).
  // When this field is left `nil`, the limit is effectively infinite.
  // +optional
  optional int32 borrowingLimitPercent = 4;
}

  //
  // BorrowingCL(i) = round( NominalCL(i) * borrowingLimitPercent(i)/100.0 )
  //
  // The value of this field can be more than 100, implying that this
  // priority level can borrow a number of seats that is greater than
  // its own nominal concurrency limit (NominalCL).
  // When this field is left `nil`, the limit is effectively infinite.
  // +optional
  optional int32 borrowingLimitPercent = 4;
}

  optional string completedIndexes = 7;

  // uncountedTerminatedPods holds the UIDs of Pods that have terminated but
  // the job controller hasn't yet accounted for in the status counters.
  //
  // The job controller creates pods with a finalizer. When a pod terminates
  // (succeeded or failed), the controller does three steps to account for it
  // in the job status:
  //
  // 1. Add the pod UID to the arrays in this field.