return err
		}).
		Setup(istio.Setup(nil, func(ctx resource.Context, cfg *istio.Config) {
			var isExternalControlPlane bool
			for _, cluster := range ctx.AllClusters() {
				if cluster.IsExternalControlPlane() {
					isExternalControlPlane = true
				}
			}

			cfg.ControlPlaneValues = generateConfigYaml(certs, false, isExternalControlPlane)
			cfg.ConfigClusterValues = generateConfigYaml(certs, true, false)
		})).

	return c.filterClusters(func(cc Cluster) bool {
		return !cc.IsExternalControlPlane()
	}, exclude(excluded...))
}

// IsExternalControlPlane indicates whether the clusters are set up in an enternal
// control plane configuration. An external control plane is a primary cluster that
// gets its Istio configuration from a different cluster.
func (c Clusters) IsExternalControlPlane() bool {
	for _, cc := range c {

{{- if not .isExternalControlPlane }}
components:
  egressGateways:
  - enabled: true
    name: istio-egressgateway
values:
   gateways:
      istio-egressgateway:
         secretVolumes:
         - name: client-custom-certs
           secretName: egress-gw-cacerts
           mountPath: /etc/certs/custom
{{- end }}
`, map[string]bool{"isExternalControlPlane": ctx.AllClusters().IsExternalControlPlane()})

	// IsRemote returns true if this is a remote cluster, which uses a control plane
	// residing in another cluster.
	IsRemote() bool

	// IsExternalControlPlane returns true if this is a cluster containing an instance
	// of the Istio control plane but with its source of config in another cluster.
	IsExternalControlPlane() bool

	// Primary returns the primary cluster for this cluster. Will return itself if
	// IsPrimary.
	Primary() Cluster

}

func (c Topology) IsConfig() bool {
	return c.Config().Name() == c.Name()
}

func (c Topology) IsRemote() bool {
	return !c.IsPrimary()
}

func (c Topology) IsExternalControlPlane() bool {
	return c.IsPrimary() && !c.IsConfig()
}

func (c Topology) Primary() Cluster {
	cluster, ok := c.AllClusters[c.PrimaryClusterName]
	if !ok || cluster == nil {

		iopFiles:             iopFiles,
		ingress:              map[string]map[string]ingress.Instance{},
		istiod:               map[string]istiokube.PortForwarder{},
		externalControlPlane: ctx.AllClusters().IsExternalControlPlane(),
	}

	t0 := time.Now()
	defer func() {
		ctx.RecordTraceEvent("istio-deploy", time.Since(t0).Seconds())
	}()
	i.id = ctx.TrackResource(i)

	if !cfg.DeployIstio {

	}

	return fmt.Sprintf(`
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
%s
`, data)
}

func (c *Config) fillDefaults(ctx resource.Context) {
	if ctx.AllClusters().IsExternalControlPlane() {
		c.PrimaryClusterIOPFile = IntegrationTestExternalIstiodPrimaryDefaultsIOP
		c.ConfigClusterIOPFile = IntegrationTestExternalIstiodConfigDefaultsIOP
		if c.ConfigClusterValues == "" {

	_, err := c.Kube().CoreV1().ConfigMaps(cm.namespace).Update(context.TODO(), cfgMap, metav1.UpdateOptions{})
	if err != nil {
		return err
	}
	if c.IsExternalControlPlane() {
		// Normal control plane uses ConfigMap informers to load mesh config. This is ~instant.
		// The external config uses a file mounted ConfigMap. This is super slow, but we can trigger it explicitly: