HUBS ?= $(HUB)

# If tag not explicitly set in users' .istiorc.mk or command line, default to the git sha.
TAG ?= $(shell git rev-parse --verify HEAD)
ifeq ($(TAG),)
  $(error "TAG cannot be empty")
endif

PULL_POLICY ?= IfNotPresent
ifeq ($(TAG),latest)
  PULL_POLICY = Always
endif
ifeq ($(PULL_POLICY),)

```bash
HUB=docker.io/<your-account> TAG=latest make docker.operator
```

This builds the controller binary and docker file, and pushes the image to the specified hub with the `latest` tag.
Once the images are pushed, configure kubectl to point to your cluster and install the controller.

Install the controller manifest:

```bash
istioctl operator init --hub docker.io/<your-account> --tag latest
kubectl create ns istio-system

```bash
iop istio-control istio-discovery $IBASE/istio-control/istio-discovery \
            --set global.istioNamespace=istio-system

# Second istio-discovery, using master version of istio
TAG=latest HUB=gcr.io/istio-testing iop istio-master istio-discovery-master $IBASE/istio-control/istio-discovery \
            --set policy.enable=false \
            --set global.istioNamespace=istio-master
```

### Gateways

        xcs--Join-->acs
        fcs--Join-->acs
        mcs--Join-->acs
    end
    subgraph VMs
        vmhc("Health Check")
        vmar("Auto Registration")
    end
    subgraph Gateway
        twc("Tag Watcher")
        gdc("Gateway Deployment")
        gcc("Gateway Class")
        twc--Depends-->gdc
        gdc-.-gcc
    end
    subgraph Ingress
        ic("Ingress Controller")

  // Defaults to File.
  // Cannot be updated.
  // +optional
  optional string terminationMessagePolicy = 20;

  // Image pull policy.
  // One of Always, Never, IfNotPresent.
  // Defaults to Always if :latest tag is specified, or IfNotPresent otherwise.
  // Cannot be updated.
  // More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
  // +optional
  optional string imagePullPolicy = 14;

  // +optional
  optional ImageReviewStatus status = 3;
}

// ImageReviewContainerSpec is a description of a container within the pod creation request.
message ImageReviewContainerSpec {
  // This can be in the form image:tag or image@SHA:012345679abcdef.
  // +optional
  optional string image = 1;
}

// ImageReviewSpec is a description of the pod creation request.
message ImageReviewSpec {