rm -rf work
mkdir work
go build -o work/mkzip mkzip.go # build now for correct paths in build errors
cd work
mkdir zoneinfo
curl -sS -L -O https://www.iana.org/time-zones/repository/releases/tzcode$CODE.tar.gz
curl -sS -L -O https://www.iana.org/time-zones/repository/releases/tzdata$DATA.tar.gz
tar xzf tzcode$CODE.tar.gz
tar xzf tzdata$DATA.tar.gz

if ! make CFLAGS=-DSTD_INSPIRED AWK=awk TZDIR=zoneinfo posix_only >make.out 2>&1; then

The zoneinfo.zip archive contains time zone files compiled using
the code and data maintained as part of the IANA Time Zone Database.
The IANA asserts that the database is in the public domain.

For more information, see
https://www.iana.org/time-zones
ftp://ftp.iana.org/tz/code/tz-link.html
https://datatracker.ietf.org/doc/html/rfc6557

  optional string schedule = 1;

  // The time zone name for the given schedule, see https://en.wikipedia.org/wiki/List_of_tz_database_time_zones.
  // If not specified, this will default to the time zone of the kube-controller-manager process.
  // The set of valid time zone names and the time zone offset is loaded from the system-wide time zone

  // in the zone and nodeName fields instead.
  // +optional
  map<string, string> deprecatedTopology = 5;

  // nodeName represents the name of the Node hosting this endpoint. This can
  // be used to determine endpoints local to a Node.
  // +optional
  optional string nodeName = 6;

  // zone is the name of the Zone this endpoint exists in.
  // +optional
  optional string zone = 7;

  // items is the list of endpoint slices
  repeated EndpointSlice items = 2;
}

// ForZone provides information about which zones should consume this endpoint.
message ForZone {
  // name represents the name of the zone.
  optional string name = 1;

```sh
firewall-cmd --get-active-zones
```

This command gets the active zone(s). Now, apply port rules to the relevant zones returned above. For example if the zone is `public`, use

```sh
firewall-cmd --zone=public --add-port=9000/tcp --permanent
```

  optional string schedule = 1;

  // The time zone name for the given schedule, see https://en.wikipedia.org/wiki/List_of_tz_database_time_zones.
  // If not specified, this will default to the time zone of the kube-controller-manager process.
  // The set of valid time zone names and the time zone offset is loaded from the system-wide time zone

### Install Control plane

This can run in any cluster. A mesh should have at least one cluster should run Pilot or equivalent XDS server,
and it is recommended to have Pilot running in each region and in multiple availability zones for multi cluster.

```bash
iop istio-control istio-discovery $IBASE/istio-control/istio-discovery \
            --set global.istioNamespace=istio-system

# Second istio-discovery, using master version of istio

  <issueManagement>
    <system>jira</system>
    <url>http://jira.codehaus.org/browse/MPA</url>
  </issueManagement>
  <ciManagement>
    <system>continuum</system>
    <url>http://maven.zones.apache.org:8080/continuum</url>
    <notifiers>
      <notifier>
        <type>mail</type>
        <configuration>
          <address>******@****.***</address>
        </configuration>
      </notifier>

  <issueManagement>
    <system>jira</system>
    <url>http://jira.codehaus.org/browse/MPA</url>
  </issueManagement>
  <ciManagement>
    <system>continuum</system>
    <url>http://maven.zones.apache.org:8080/continuum</url>
    <notifiers>
      <notifier>
        <type>mail</type>
        <configuration>
          <address>******@****.***</address>
        </configuration>
      </notifier>