func (m *Multicluster) checkShouldLead(client kubelib.Client, systemNamespace string, stop <-chan struct{}) bool {
	var res bool
	if features.ExternalIstiod {
		b := backoff.NewExponentialBackOff(backoff.DefaultOption())
		ctx, cancel := context.WithCancel(context.Background())
		go func() {
			select {
			case <-stop:
				cancel()
			case <-ctx.Done():

	ClusterName = env.Register("CLUSTER_ID", constants.DefaultClusterName,
		"Defines the cluster and service registry that this Istiod instance belongs to").Get()

	ExternalIstiod = env.Register("EXTERNAL_ISTIOD", false,
		"If this is set to true, one Istiod will control remote clusters including CA.").Get()

	EnableCAServer = env.Register("ENABLE_CA_SERVER", true,

		{"Values.global.centralIstiod", "Values.global.externalIstiod", false},
		{"Values.global.arch", "the affinity of k8s settings", nil},
	}

	failHardSettings := []deprecatedSettings{
		{"Values.grafana.enabled", "the samples/addons/ deployments", false},

    caAddress: ""
    # Configure a remote cluster data plane controlled by an external istiod.
    # When set to true, istiod is not deployed locally and only a subset of the other
    # discovery charts are enabled.
    externalIstiod: true
    # Configure a remote cluster as the config cluster for an external istiod.
    configCluster: false
    # configValidation enables the validation webhook for Istio configuration.
    configValidation: true

    # Configure a remote cluster data plane controlled by an external istiod.
    # When set to true, istiod is not deployed locally and only a subset of the other
    # discovery charts are enabled.
    externalIstiod: false

    # Configure a remote cluster as the config cluster for an external istiod.
    configCluster: false

    # configValidation enables the validation webhook for Istio configuration.

	# copy istio-discovery values, but apply some local customizations
	cp manifests/charts/istio-control/istio-discovery/values.yaml manifests/charts/istiod-remote/
	yq -i '.defaults.telemetry.enabled=false | .defaults.global.externalIstiod=true | .defaults.global.omitSidecarInjectorConfigMap=true | .defaults.pilot.configMap=false' manifests/charts/istiod-remote/values.yaml
	warning=$$(cat manifests/helm-profiles/warning-edit.txt | sed ':a;N;$$!ba;s/\n/\\n/g') ; \

          "enabled": true
        },
        "defaultResources": {
          "requests": {
            "cpu": "10m"
          }
        },
        "enabled": true,
        "externalIstiod": false,
        "hub": "gcr.io/istio-testing",
        "imagePullPolicy": "",
        "imagePullSecrets": [],
        "istioNamespace": "istio-system",
        "istiod": {

"remote" profile instead. apiVersion: install.istio.io/v1alpha1 kind: IstioOperator spec: components: base: enabled: false pilot: enabled: false ingressGateways: - name: istio-ingressgateway enabled: false istiodRemote: enabled: true values: global: externalIstiod: true omitSidecarInjectorC: true configCluster: false pilot: configMap: false telemetry: enabled: false manifests/profiles/remote.yaml # The remote profile is used to configure a mesh cluster without a locally deployed control plane. # Only the...

  google.protobuf.BoolValue mountMtlsCerts = 60;

  // The address of the CA for CSR.
  string caAddress = 61;

  // Controls whether one external istiod is enabled.
  google.protobuf.BoolValue externalIstiod = 62;

  // Controls whether a remote cluster is the config cluster for an external istiod
  google.protobuf.BoolValue configCluster = 64;

  // The name of the CA for workloads.

          "enabled": true
        },
        "defaultResources": {
          "requests": {
            "cpu": "10m"
          }
        },
        "enabled": false,
        "externalIstiod": false,
        "hub": "docker.io/istio",
        "imagePullPolicy": "",
        "imagePullSecrets": [],
        "istioNamespace": "istio-system",
        "istiod": {
          "enableAnalysis": false