"ipam": {},
  "dns": {},
  "plugin_log_level": "debug",
  "log_uds_address": "",
  "cni_event_address": "/tmp/cnieventfoo",
  "ambient_enabled": false,
  "kubernetes": {
    "kubeconfig": "/etc/cni/net.d/ZZZ-istio-cni-kubeconfig",
    "exclude_namespaces": [
      "istio-system"
    ]
  }

      "cni_event_address": "/tmp/cnieventfoo",
      "dns": {},
      "ipam": {},
      "kubernetes": {
        "exclude_namespaces": [
          "istio-system"
        ],
        "kubeconfig": "/etc/cni/net.d/ZZZ-istio-cni-kubeconfig"
      },
      "log_uds_address": "",
      "name": "istio-cni",
      "plugin_log_level": "debug",
      "type": "istio-cni"
    }
  ]

      "plugin_log_level": "info",
      "mtu": 1500,
      "ipam": {
        "type": "calico-ipam"
      },
      "policy": {
        "type": "k8s"
      },
      "kubernetes": {
        "kubeconfig": "/etc/cni/net.d/calico-kubeconfig"
      }
    },
    {
      "type": "portmap",
      "snat": true,
      "capabilities": {
        "portMappings": true
      }
    }
  ]

			Synced: atomic.NewBool(synced),
		}
	})
	return tc
}

var kubeconfig = 0

func (t *testController) AddSecret(secretName, clusterID string) {
	kubeconfig++
	t.secrets.CreateOrUpdate(makeSecret(secretNamespace, secretName, clusterCredential{clusterID, []byte(fmt.Sprintf("kubeconfig-%d", kubeconfig))}))
}

func (t *testController) DeleteSecret(secretName string) {
	t.t.Helper()

      "plugin_log_level": "info",
      "mtu": 1500,
      "ipam": {
        "type": "calico-ipam"
      },
      "policy": {
        "type": "k8s"
      },
      "kubernetes": {
        "kubeconfig": "/etc/cni/net.d/calico-kubeconfig"
      }
    },
    {
      "type": "portmap",
      "snat": true,
      "capabilities": {
        "portMappings": true
      }
    }
  ]

: "${KUBE_CONFIG_FILE:="config-test.sh"}"

export KUBECTL KUBE_CONFIG_FILE

source "${KUBE_ROOT}/cluster/kube-util.sh"

function detect-master-from-kubeconfig() {
    export KUBECONFIG=${KUBECONFIG:-$DEFAULT_KUBECONFIG}

    local cc
    cc=$("${KUBE_ROOT}/cluster/kubectl.sh" config view -o jsonpath="{.current-context}")
    if [[ -n "${KUBE_CONTEXT:-}" ]]; then
      cc="${KUBE_CONTEXT}"

apiVersion: release-notes/v2
kind: bug-fix
area: installation
releaseNotes:
- |
  **Removed** support for a number of nonstandard kubeconfig authentication methods when using multicluster secret.

upgradeNotes:
- title: Multicluster Secret Authentication Changes
  content: |
    When kubeconfig files are created to [enable endpoint discovery](https://istio.io/latest/docs/setup/install/multicluster/multi-primary/#enable-endpoint-discovery)

	}
	volMountMap[kubeadmconstants.KubeControllerManager]["kubeconfig"] = v1.VolumeMount{
		Name:      "kubeconfig",
		MountPath: controllerManagerConfig,
		ReadOnly:  true,
	}
	volMountMap[kubeadmconstants.KubeScheduler] = map[string]v1.VolumeMount{}
	volMountMap[kubeadmconstants.KubeScheduler]["kubeconfig"] = v1.VolumeMount{
		Name:      "kubeconfig",
		MountPath: schedulerConfig,
		ReadOnly:  true,
	}

	out, err = p.Runner.RunCmd("version", "", p.KubeConfig, p.KubeContext, p.DryRun)
	if err != nil {
		return nil, err
	}
	ret["kubectl-version"] = out
	return ret, nil
}

// GetClusterContext returns the cluster context.
func GetClusterContext(runner *kubectlcmd.Runner, kubeConfig string) (string, error) {
	return runner.RunCmd("config current-context", "", kubeConfig, "", false)
}

              path: istio-token
      - name: cacerts
        secret:
          optional: true
          secretName: cacerts
      - name: istio-kubeconfig
        secret:
          optional: true
          secretName: istio-kubeconfig
      - name: istio-csr-dns-cert
        secret:
          optional: true
          secretName: istiod-tls
      - configMap:
          defaultMode: 420