"configValidation": true,
    "defaultPodDisruptionBudget": {
      "enabled": true
    },
    "defaultResources": {
      "requests": {
        "cpu": "10m"
      }
    },
    "enabled": false,
    "externalIstiod": false,
    "hub": "gcr.io/istio-testing",
    "imagePullPolicy": "",
    "imagePullSecrets": [],
    "istioNamespace": "istio-system",
    "istiod": {
      "enableAnalysis": false
    },

    "configValidation": true,
    "defaultPodDisruptionBudget": {
      "enabled": true
    },
    "defaultResources": {
      "requests": {
        "cpu": "10m"
      }
    },
    "enabled": false,
    "externalIstiod": false,
    "hub": "gcr.io/istio-testing",
    "imagePullPolicy": "",
    "imagePullSecrets": [
      "barSecret"
    ],
    "istioNamespace": "istio-system",
    "istiod": {
      "enableAnalysis": false

    # Must be set for any cluster configured with private docker registry.
    imagePullSecrets: []

    # Used to locate istiod.
    istioNamespace: istio-system

    externalIstiod: false
    remotePilotAddress: ""

    # Platform where Istio is deployed. Possible values are: "openshift", "gcp".
    # An empty value means it is a vanilla Kubernetes distribution, therefore no special

  - apiGroups: ["authentication.k8s.io"]
    resources: ["tokenreviews"]
    verbs: ["create"]
  - apiGroups: ["authorization.k8s.io"]
    resources: ["subjectaccessreviews"]
    verbs: ["create"]
{{- if .Values.global.externalIstiod }}
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["create", "get", "list", "watch", "update"]
  - apiGroups: ["admissionregistration.k8s.io"]
    resources: ["mutatingwebhookconfigurations"]

  - apiGroups: ["authentication.k8s.io"]
    resources: ["tokenreviews"]
    verbs: ["create"]
  - apiGroups: ["authorization.k8s.io"]
    resources: ["subjectaccessreviews"]
    verbs: ["create"]
{{- if .Values.global.externalIstiod }}
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["create", "get", "list", "watch", "update"]
  - apiGroups: ["admissionregistration.k8s.io"]
    resources: ["mutatingwebhookconfigurations"]

    "configValidation": true,
    "defaultPodDisruptionBudget": {
      "enabled": true
    },
    "defaultResources": {
      "requests": {
        "cpu": "10m"
      }
    },
    "enabled": false,
    "externalIstiod": false,
    "hub": "gcr.io/istio-testing",
    "imagePullPolicy": "",
    "imagePullSecrets": [],
    "istioNamespace": "istio-system",
    "istiod": {
      "enableAnalysis": false
    },

	if _, f := knownClusterNames[c.Name()]; f {
		return c.Name()
	}
	if c.IsPrimary() {
		if c.IsConfig() {
			prefix = "primary"
		} else {
			prefix = "externalistiod"
		}
	} else if c.IsRemote() {
		if c.IsConfig() {
			prefix = "config"
		} else {
			prefix = "remote"
		}
	}

	return fmt.Sprintf("%s-%d", prefix, c.Index)
}

	// Istiod is running on the external cluster. Use the inCluster credentials to
	// create a kubeclientset
	if features.LocalClusterSecretWatcher && features.ExternalIstiod {
		config, err := kube.InClusterConfig(configOverrides...)
		if err != nil {
			log.Errorf("Could not get istiod incluster configuration: %v", err)
			return nil
		}

	IntegrationTestExternalIstiodPrimaryDefaultsIOP = "tests/integration/iop-externalistiod-primary-integration-test-defaults.yaml"

	// IntegrationTestExternalIstiodConfigDefaultsIOP is the path of the default IstioOperator spec to use
	// on external istiod config clusters for integration tests
	IntegrationTestExternalIstiodConfigDefaultsIOP = "tests/integration/iop-externalistiod-config-integration-test-defaults.yaml"

	verifyControllers(t, mc, 1, "delete remote controller")
}

func Test_KubeSecretController_ExternalIstiod_MultipleClusters(t *testing.T) {
	test.SetForTest(t, &features.ExternalIstiod, true)
	test.SetForTest(t, &features.InjectionWebhookConfigName, "")
	mockserviceController := newMockserviceController()
	clientset := kube.NewFakeClient()
	stop := test.NewStop(t)
	s := server.New()