GetTrustedCa().
		GetInlineBytes()

	// seems as though the most straightforward way to tell whether this is a root ca or not
	// is to check whether the inline bytes of the cert chain or the trusted ca field is zero length
	if len(certChainSecret) > 0 {
		builder.Data(string(certChainSecret))
	} else if len(caDataSecret) > 0 {
		builder.Data(string(caDataSecret))
	}

	secret, err := builder.Build()
	if err != nil {

  // is ready).
  // +optional
  optional int32 minReadySeconds = 4;

  // The number of old history to retain to allow rollback.
  // This is a pointer to distinguish between explicit zero and not specified.
  // Defaults to 10.
  // +optional
  optional int32 revisionHistoryLimit = 6;
}

// DaemonSetStatus represents the current status of a daemon set.
message DaemonSetStatus {

      token:
        aud: istio-ca

    sts:
      # The service port used by Security Token Service (STS) server to handle token exchange requests.
      # Setting this port to a non-zero value enables STS server.
      servicePort: 0

    # The name of the CA for workload certificates.
    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates

  // The number of successful finished jobs to retain.
  // This is a pointer to distinguish between explicit zero and not specified.
  // Defaults to 3.
  // +optional
  optional int32 successfulJobsHistoryLimit = 6;

  // The number of failed finished jobs to retain.
  // This is a pointer to distinguish between explicit zero and not specified.
  // Defaults to 1.
  // +optional
  optional int32 failedJobsHistoryLimit = 7;
}

	"istio.io/istio/pkg/test/util/assert"
)

func TestDescribeRouteDomains(t *testing.T) {
	tests := []struct {
		desc     string
		domains  []string
		expected string
	}{
		{
			desc:     "test zero domain",
			domains:  []string{},
			expected: "",
		},
		{
			desc:     "test only one domain",
			domains:  []string{"example.com"},
			expected: "example.com",
		},
		{

However, this has one glaring issue: how do we get the traffic to the remote proxies, while maintaining the zero-trust properties that Istio is built upon?

A secondary goal was to enable a smoother on-ramp from "Zero" to "Getting some value".
Historically, Istio had to really be consumed all-or-nothing for things to work as expected.

// a certain combination:
// - no object exists with suitable topology and storage class name
// - such an object exists, but the capacity is unset
// - such an object exists, but the capacity is zero
//
// The producer of these objects can decide which approach is more suitable.
//
// They are consumed by the kube-scheduler when a CSI driver opts into

  // automatically deleted. When the Job is being deleted, its lifecycle
  // guarantees (e.g. finalizers) will be honored. If this field is unset,
  // the Job won't be automatically deleted. If this field is set to zero,
  // the Job becomes eligible to be deleted immediately after it finishes.
  // +optional
  optional int32 ttlSecondsAfterFinished = 8;

  // completionMode specifies how Pod completions are tracked. It can be

// a certain combination:
// - no object exists with suitable topology and storage class name
// - such an object exists, but the capacity is unset
// - such an object exists, but the capacity is zero
//
// The producer of these objects can decide which approach is more suitable.
//
// They are consumed by the kube-scheduler when a CSI driver opts into

      install_calico "" "$(dirname "$CONFIG")"
      ;;

    "")
      # perfectly fine, we accepted the default KinD CNI
      ;;

    *)
      # we don't know what to do but we've got no CNI, return non-zero
      echo "${KUBERNETES_CNI} is not recognized. Supported options are \"calico\" or do not set the variable to use default."
      return 1
      ;;
  esac