# If not set explicitly, default to the Istio discovery address.
    caAddress: ""

    # Configure a remote cluster data plane controlled by an external istiod.
    # When set to true, istiod is not deployed locally and only a subset of the other
    # discovery charts are enabled.
    externalIstiod: false

    # Configure a remote cluster as the config cluster for an external istiod.
    configCluster: false

                      type: string
                    timeout:
                      description: The maximum amount of time that the resolver, determined
                        by the PILOT_JWT_ENABLE_REMOTE_JWKS environment variable,
                        will spend waiting for the JWKS to be fetched.
                      type: string
                  required:
                  - issuer

	# external istiod remote cluster charts
	cp manifests/charts/base/templates/services.yaml manifests/charts/istiod-remote/templates
	cp manifests/charts/base/templates/endpoints.yaml manifests/charts/istiod-remote/templates
	cp manifests/charts/base/templates/reader-serviceaccount.yaml manifests/charts/istiod-remote/templates

For various reasons outside the scope of this document, there is a desire to move from a sidecar based architecture to a "remote proxy" architecture.
However, this has one glaring issue: how do we get the traffic to the remote proxies, while maintaining the zero-trust properties that Istio is built upon?

A secondary goal was to enable a smoother on-ramp from "Zero" to "Getting some value".

                      type: string
                    timeout:
                      description: The maximum amount of time that the resolver, determined
                        by the PILOT_JWT_ENABLE_REMOTE_JWKS environment variable,
                        will spend waiting for the JWKS to be fetched.
                      type: string
                  required:
                  - issuer

    # If not set explicitly, default to the Istio discovery address.
    caAddress: ""
    # Configure a remote cluster data plane controlled by an external istiod.
    # When set to true, istiod is not deployed locally and only a subset of the other
    # discovery charts are enabled.
    externalIstiod: true
    # Configure a remote cluster as the config cluster for an external istiod.
    configCluster: false

            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: spec.serviceAccountName
          - name: KUBECONFIG
            value: /var/run/secrets/remote/config
          {{- if .Values.pilot.env }}
          {{- range $key, $val := .Values.pilot.env }}
          - name: {{ $key }}
            value: "{{ $val }}"
          {{- end }}
          {{- end }}