# (Certificates must be obtained before this step.  The --cert-dir flag lets istioctl bypass the Kubernetes API server.)
  istioctl ps --xds-address istio.example.com:15012 --cert-dir ~/.istio-certs

  # Retrieve proxy status information via XDS from specific control plane in multi-control plane in-cluster configuration

```

3) `istio-control/istio-discovery` chart installs a revision of istiod.

```console
 helm install -n istio-system istiod manifests/charts/istio-control/istio-discovery --set profile=openshift
```

4) `gateways` charts install a load balancer with `ingress` and `egress`.

Ingress secrets and access should be separated from the control plane.

```console

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  profile: empty
  hub: docker.io/istio
  tag: 1.1.4
  meshConfig:
    rootNamespace: istio-control
  components:
    base:
      enabled: true
      k8s:
        # Base component only allows overlays field.
        overlays:
          - kind: ServiceAccount
            name: istio-reader-service-account
            patches:
              # Select list item by value

// it under the terms of the GNU Affero General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// This program is distributed in the hope that it will be useful
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU Affero General Public License for more details.
//

// it under the terms of the GNU Affero General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// This program is distributed in the hope that it will be useful
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU Affero General Public License for more details.
//

// Test that the Identity op has been created to fetch the file prefix
// argument. It should also have control dependency to the `SaveV2` op.
// CHECK: %[[IDENTITY:.*]], %[[CTL_1:.*]] = tf_executor.island(%[[CTL_0]]) wraps "tf.Identity"(%[[ARG_0]])
// CHECK: tf_executor.fetch %[[CTL_1]] : !tf_executor.control
// CHECK: return

// -----

// Test that no ops are added to @main when @tf_quant__save function does
// not exist.

  SetControlInputs(op, preds_in_reverse_program_order,
                   num_control_inputs_added);
}

// This function updates all control dependencies in `func`, represented as
// control inputs for island and fetch ops of the graph body in `func`.
// We rely on side effect analysis and propagate the queried dependencies to
// the island and fetch ops.

components, particularly the waypoint, can specify which control plane they connect to (and by inference what version of the data plane they will run) using the `istio.io/rev` label set to a tag or revision.

As in sidecar mode, every control plane installation may (and should) include a revision name, which is a stable identifier for that control plane installation and version.  For simplicity, we recommend using the version of the control plane as the revision name (see [./istio/control-pla...

	ControllerManagerExtraArgs = "controller-manager-extra-args"

	// ControlPlaneEndpoint flag sets a stable IP address or DNS name for the control plane.
	ControlPlaneEndpoint = "control-plane-endpoint"

	// DryRun flag instructs kubeadm to don't apply any changes; just output what would be done.
	DryRun = "dry-run"

// it under the terms of the GNU Affero General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// This program is distributed in the hope that it will be useful
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU Affero General Public License for more details.
//