metricsInstance: enabled: false selfMonitoring: enabled: false grafanaAgent: installOperator: false enableConfigReadAPI: false lokiCanary: enabled: false singleBinary: replicas: 1 gateway: enabled: false manifests/addons/values-grafana.yaml # Avoid creating a bunch of RBAC rules for features we are not enabling rbac: create: false pspEnabled: false # Disable test pods testFramework: enabled: false podLabels: sidecar.istio.io/inject: "false" # Demo only, so we will have no authentication admin: existingSecret:...

This has two implementations:
* The Credentials controller is responsible for reading TLS certificates, stored as Secrets.
* The Kubernetes Service Discovery controller is a bit of a monolith, and spins off a bunch of other sub-controllers in addition to the core service discovery controller.

Because of the monolithic complexity it helps to see this magnified a bit:

```mermaid
graph BT
    mcsc("Multicluster Secret")