case config.PolicyOPASubSys:
		// In case legacy OPA config is being set, we treat it as if the
		// AuthZPlugin is being set.
		subSys = config.PolicyPluginSubSys
		fallthrough
	case config.PolicyPluginSubSys:
		if ppargs, err := polplugin.LookupConfig(s, GetDefaultConnSettings(), xhttp.DrainBody); err != nil {
			return err
		} else if ppargs.URL == nil {
			// Check if legacy opa is configured.

      "tf.OpA"(%0) : (tensor<f32>) -> ()
    }
    ```

    will be transformed into:

    ``mlir
    %0 = "tf.ReadVariableOp"(%arg0) : (tensor<*x!tf_type.resource<tensor<f32>>>) -> tensor<f32>
    tf_device.replicate {n = 2 : i32} {
      "tf.OpA"(%0) : (tensor<f32>) -> ()
    }
    ```

          %0 = "tf.opA"(%arg0) : (tensor<f32>) -> tensor<f32>
          return %0 : tensor<f32>
        }
      }
    }
    ```

    will be transformed into:

    ```mlir
    module  {
      func @foo(%arg0: tensor<f32>) -> tensor<f32> {
        %0 = tf_executor.graph {
          %outputs, %control = tf_executor.island {
            %1 = "tf.opA"(%arg0) : (tensor<f32>) -> tensor<f32>

	}

	if authZPluginCfg.URL == nil {
		opaCfg, err := opa.LookupConfig(s[config.PolicyOPASubSys][config.Default],
			NewHTTPTransport(), xhttp.DrainBody)
		if err != nil {
			iamLogIf(ctx, fmt.Errorf("Unable to initialize AuthZPlugin from legacy OPA config: %w", err))
		} else {
			authZPluginCfg.URL = opaCfg.URL
			authZPluginCfg.AuthToken = opaCfg.AuthToken

}

// CHECK-LABEL: func @variant_input_output_already_marked
func.func @variant_input_output_already_marked() {
  // CHECK: "tf.opA"
  // CHECK-SAME: _xla_outside_compilation = "0"
  // CHECK: "tf.opB"
  // CHECK-SAME: _xla_outside_compilation = "0"
  "tf_device.cluster"() ({
    %1= "tf.opA"() {_xla_outside_compilation = "0"} : () -> tensor<!tf_type.variant<tensor<f32>>>

    enableNamespacesByDefault: false
    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.

  %0 = "tf.VarHandleOp"() {container = "c", shared_name = "v"} : () -> tensor<*x!tf_type.resource<tensor<2x8xi32>>>
  %1 = "tf.Const"() {value = dense<1> : tensor<i32>} : () -> tensor<i32>
  "tf_device.cluster"() ({
    "tf.OpA"(%0, %1) {f = @reachable_function} : (tensor<*x!tf_type.resource<tensor<2x8xi32>>>, tensor<i32>) -> ()
    tf_device.return
  }) : () -> ()
  func.return
}

// CHECK-LABEL: func @reachable_function

        // a role as connection between `tf.TPUReplicatedInput` or
        // `tf.TPUPartitionedInput`. For example, we have the follow pseudocode:
        // %0 = tf_executor.island wraps "tf.OpA" (){_replication_info = 'c'}
        // %1 = tf_executor.island wraps "tf.Identity(%0)
        // %2 = tf_executor.island wraps "tf.TPUReplicatedInput"(%1)

        if (!isa<TF::TPUReplicatedInputOp, TF::TPUPartitionedInputOp,

    enableNamespacesByDefault: false

    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.

This operation holds a replicated input to a `tpu.replicate()` computation subgraph.
Each replicated input has the same shape and type alongside the output.

For example:
```
%a = "tf.opA"()
%b = "tf.opB"()
%replicated_input = "tf.TPUReplicatedInput"(%a, %b)
%computation = "tf.Computation"(%replicated_input)
```
The above computation has a replicated input of two replicas.
  }];