istioctl --kubeconfig=c0.yaml create-remote-secret --name c0 \
    | kubectl --kubeconfig=c1.yaml apply -f -

  # Delete a secret that was previously installed in c1
  istioctl --kubeconfig=c0.yaml create-remote-secret --name c0 \
    | kubectl --kubeconfig=c1.yaml delete -f -

  # Create a secret access a remote cluster with an auth plugin

    {
      "ambient_enabled": false,
      "cni_event_address": "",
      "dns": {},
      "ipam": {},
      "kubernetes": {
        "exclude_namespaces": [
          ""
        ],
        "kubeconfig": "/path/to/kubeconfig"
      },
      "log_uds_address": "",
      "name": "istio-cni",
      "plugin_log_level": "debug",
      "type": "istio-cni"
    }
  ]

	if len(config.Clusters) < 1 {
		return nil, errors.New("the provided kubeconfig file must have at least one Cluster defined")
	}
	currentClusterName, currentCluster := kubeconfigutil.GetClusterFromKubeConfig(config)
	if currentCluster == nil {
		return nil, errors.New("the provided kubeconfig file must have a unnamed Cluster or a CurrentContext that specifies a non-nil Cluster")
	}

      "plugin_log_level": "info",
      "mtu": 1500,
      "ipam": {
        "type": "calico-ipam"
      },
      "policy": {
        "type": "k8s"
      },
      "kubernetes": {
        "kubeconfig": "/etc/cni/net.d/calico-kubeconfig"
      }
    },
    {
      "type": "portmap",
      "snat": true,
      "capabilities": {
        "portMappings": true
      }
    }
  ]

	"istio.io/istio/pkg/kube"
)

const (
	defaultTimeoutDurationStr = "10m"
)

// New creates a rest.Config and Clientset from the given kubeconfig path and Context.
func New(kubeconfig, kubeContext string) (*rest.Config, *kubernetes.Clientset, error) {
	clientConfig := kube.BuildClientCmd(kubeconfig, kubeContext, func(co *clientcmd.ConfigOverrides) {
		co.Timeout = defaultTimeoutDurationStr
	})
	restConfig, err := clientConfig.ClientConfig()

              path: istio-token
      - name: cacerts
        secret:
          optional: true
          secretName: cacerts
      - name: istio-kubeconfig
        secret:
          optional: true
          secretName: istio-kubeconfig
      - name: istio-csr-dns-cert
        secret:
          optional: true
          secretName: istiod-tls
      - configMap:
          defaultMode: 420

    },
    {
      "sysctl": {
        "net.core.somaxconn": "500"
      },
      "type": "tuning"
    },
    {
      "kubernetes": {
        "cni_bin_dir": "/path/cni/bin",
        "kubeconfig": "/path/to/kubeconfig"
      },
      "name": "istio-cni",
      "plugin_log_level": "debug",
      "type": "istio-cni"
    }
  ]

		}
	})
	return expander, nil
}

// AddFlags binds client configuration flags to a given flagset
func (f *ConfigFlags) AddFlags(flags *pflag.FlagSet) {
	if f.KubeConfig != nil {
		flags.StringVar(f.KubeConfig, "kubeconfig", *f.KubeConfig, "Path to the kubeconfig file to use for CLI requests.")
	}
	if f.CacheDir != nil {
		flags.StringVar(f.CacheDir, flagCacheDir, *f.CacheDir, "Default cache directory")
	}

    {
      "ambient_enabled": false,
      "cni_event_address": "",
      "dns": {},
      "ipam": {},
      "kubernetes": {
        "exclude_namespaces": [
          ""
        ],
        "kubeconfig": "/path/to/kubeconfig"
      },
      "log_uds_address": "",
      "name": "istio-cni",
      "plugin_log_level": "debug",
      "type": "istio-cni"
    }
  ]

    echo "Fetching kubelet bootstrap-kubeconfig file from metadata"
    get-metadata-value "instance/attributes/bootstrap-kubeconfig" >/var/lib/kubelet/bootstrap-kubeconfig
  else
    echo "Fetching kubelet kubeconfig file from metadata"
    get-metadata-value "instance/attributes/kubeconfig" >/var/lib/kubelet/kubeconfig
  fi
}