certChainSecret := secretTyped.
		GetTlsCertificate().
		GetCertificateChain().
		GetInlineBytes()
	caDataSecret := secretTyped.
		GetValidationContext().
		GetTrustedCa().
		GetInlineBytes()

	// seems as though the most straightforward way to tell whether this is a root ca or not
	// is to check whether the inline bytes of the cert chain or the trusted ca field is zero length
	if len(certChainSecret) > 0 {

	@mkdir -p ${TARGET_OUT}/logs
	@mkdir -p ${TARGET_OUT}/release

# I tried to make this dependent on what I thought was the appropriate
# lock file, but it caused the rule for that file to get run (which
# seems to be about obtaining a new version of the 3rd party libraries).
$(TARGET_OUT)/istio_is_init: bin/init.sh istio.deps | $(TARGET_OUT)
	@# Add a retry, as occasionally we see transient connection failures to GCS

		// these sometimes fail due to "Device or resource busy" - again NBD.
		{"-t", iptablesconstants.NAT, "-F", ChainHostPostrouting},
		{"-t", iptablesconstants.NAT, "-X", ChainHostPostrouting},
	}

	// iptablei seems like a reasonable pluralization of iptables
	iptablesVariant := []dep.IptablesVersion{}
	iptablesVariant = append(iptablesVariant, cfg.iptV)

	if cfg.cfg.EnableIPv6 {
		iptablesVariant = append(iptablesVariant, cfg.ipt6V)

}

func describeRouteDomains(domains []string) string {
	if len(domains) == 0 {
		return ""
	}
	if len(domains) == 1 {
		return domains[0]
	}

	// Return the shortest non-numeric domain.  Count of domains seems uninteresting.
	max := 2
	withoutPort := make([]string, 0, len(domains))
	for _, d := range domains {
		if !strings.Contains(d, ":") {
			withoutPort = append(withoutPort, d)

	}
	if isRevisioned(revision) && meshConfig.DefaultConfig.DiscoveryAddress == "" {
		meshConfig.DefaultConfig.DiscoveryAddress = IstiodAddr(istioNamespace, revision)
	}

	// performing separate map-merge, apply seems to completely overwrite all metadata
	proxyMetadata := meshConfig.DefaultConfig.ProxyMetadata

	// support proxy.istio.io/config on the WorkloadGroup, in the WorkloadGroup spec