if err != nil {
			return nil, fmt.Errorf("failed building warming secret %s: %v",
				warmingSecret.Name, err)
		}
		proxySecretItems = append(proxySecretItems, secret)
	}
	for _, activeSecret := range secretConfigDump.DynamicActiveSecrets {
		secret, err := parseDynamicSecret(activeSecret, "ACTIVE")
		if err != nil {
			return nil, fmt.Errorf("failed building warming secret %s: %v",
				activeSecret.Name, err)
		}

  echo "Copying '${2}' to ${TARGET_OUT_LINUX}/ztunnel"
  cp -f "${2}" "${TARGET_OUT_LINUX}/ztunnel"
}

function maybe_build_ztunnel() {
  # TODO detect git changes or something to avoid unnecessarily building
  # BUILD_ZTUNNEL=1 with no BUILD_ZTUNNEL_REPO tries to infer BUILD_ZTUNNEL_REPO
  if [[ "${BUILD_ZTUNNEL_REPO:-}" == "" ]] && [[ "${BUILD_ZTUNNEL:-}" != "" ]]; then
    local ZTUNNEL_DIR
	ZTUNNEL_DIR="$(pwd)/../ztunnel"

certificate provisioning tool, or use components that are centrally managed and running in a different cluster.

This is a work in progress - building on top of the multi-cluster installer.

As an extreme, the goal is to be possible to run Istio workloads in a cluster without installing any Istio component

# Create targets for TARGET_OUT_LINUX/binary
# There are two use cases here:
# * Building all docker images (generally in CI). In this case we want to build everything at once, so they share work
# * Building a single docker image (generally during dev). In this case we just want to build the single binary alone
BUILD_ALL ?= true
define build-linux

### CLI

To build the operator CLI, simply:

```bash
make build
```

Ensure the created binary is in your PATH to run the examples below.

### Controller (in cluster)

Building a custom controller requires a Dockerhub (or similar) account. To build using the container based build:

```bash
HUB=docker.io/<your-account> TAG=latest make docker.operator
```

papdaniel <******@****.***> 1627498536 +0200

## Reference

### Design details

echo "istio.io/istio/pkg/version.buildGitRevision=${BUILD_GIT_REVISION}"
echo "istio.io/istio/pkg/version.buildStatus=${tree_status}"
echo "istio.io/istio/pkg/version.buildTag=${GIT_DESCRIBE_TAG}"
echo "istio.io/istio/pkg/version.buildHub=${HUB}"
echo "istio.io/istio/pkg/version.buildOS=${BUILD_GOOS}"

			ID:        "MISSING",
			Info: istioversion.BuildInfo{
				Version: "MISSING CP ID",
			},
		}
	}

	cpID := pilotxds.IstioControlPlaneInstance{}
	err := json.Unmarshal([]byte(xdsResponse.ControlPlane.Identifier), &cpID)
	if err != nil {
		return pilotxds.IstioControlPlaneInstance{
			Component: "INVALID",
			ID:        "INVALID",
			Info: istioversion.BuildInfo{
				Version: "INVALID CP ID",
			},
		}

          )
        )
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
  name: "stable-channel-default-policy-binding.istio.io"
spec:
  policyName: "stable-channel-default-policy.istio.io"
  validationActions: [Deny]