cert1 := certs[0]
	cert2 := certs[1]

	cfgYaml := tmpl.MustEvaluate(`
values:
  pilot:
    env:
      EXTERNAL_CA: ISTIOD_RA_KUBERNETES_API
  meshConfig:
    defaultConfig:
      proxyMetadata:
        ISTIO_META_CERT_SIGNER: signer1
    trustDomainAliases: [some-other, trust-domain-foo]
    caCertificates:
    - pem: |

	// TrustDomain
	TrustDomain string
	// CertSignerDomain info
	CertSignerDomain string
}

const (
	// ExtCAK8s : Integrate with external CA using k8s CSR API
	ExtCAK8s CaExternalType = "ISTIOD_RA_KUBERNETES_API"

	// DefaultExtCACertDir : Location of external CA certificate
	DefaultExtCACertDir string = "./etc/external-ca-cert"
)

// ValidateCSR : Validate all SAN extensions in csrPEM match authenticated identities

			inIOPSpec: `
spec:
  components:
    pilot:
      k8s:
        nodeSelector:
          master: "true"
        env:
        - name: EXTERNAL_CA
          value: ISTIOD_RA_KUBERNETES_API
        - name: K8S_SIGNER
          value: kubernetes.io/legacy-unknown
  values:
    pilot:
      enabled: true
      rollingMaxSurge: 100%
      rollingMaxUnavailable: 25%
      resources:

	// TODO: Likely to be removed and added to mesh config
	externalCaType = env.Register("EXTERNAL_CA", "",
		"External CA Integration Type. Permitted value is ISTIOD_RA_KUBERNETES_API.").Get()

	// TODO: Likely to be removed and added to mesh config
	k8sSigner = env.Register("K8S_SIGNER", "",
		"Kubernetes CA Signer type. Valid from Kubernetes 1.18").Get()
)