```

3) `istio-control/istio-discovery` chart installs a revision of istiod.

```console
 helm install -n istio-system istiod manifests/charts/istio-control/istio-discovery --set profile=openshift
```

4) `gateways` charts install a load balancer with `ingress` and `egress`.

Ingress secrets and access should be separated from the control plane.

```console

  /** The HTTP {@code Access-Control-Expose-Headers} header field name. */
  public static final String ACCESS_CONTROL_EXPOSE_HEADERS = "Access-Control-Expose-Headers";
  /** The HTTP {@code Access-Control-Max-Age} header field name. */
  public static final String ACCESS_CONTROL_MAX_AGE = "Access-Control-Max-Age";
  /** The HTTP {@code Age} header field name. */

### Install Control plane

This can run in any cluster. A mesh should have at least one cluster should run Pilot or equivalent XDS server,
and it is recommended to have Pilot running in each region and in multiple availability zones for multi cluster.

```bash
iop istio-control istio-discovery $IBASE/istio-control/istio-discovery \
            --set global.istioNamespace=istio-system

	cp manifests/charts/istio-control/istio-discovery/files/injection-template.yaml manifests/charts/istiod-remote/files
	cp manifests/charts/istio-control/istio-discovery/files/gateway-injection-template.yaml manifests/charts/istiod-remote/files
	cp manifests/charts/istio-control/istio-discovery/templates/istiod-injector-configmap.yaml manifests/charts/istiod-remote/templates

    val headers = headersOf("Cache-Control", "max-age=12", "Pragma", "must-revalidate", "Pragma", "public")
    val cacheControl = parse(headers)
    assertThat(cacheControl.toString()).isEqualTo("max-age=12, public, must-revalidate")
  }

  @Test
  fun parseCacheControlHeaderValueIsRetained() {
    val value = "max-age=12"
    val headers = headersOf("Cache-Control", value)
    val cacheControl = parse(headers)

          // passes, and there is still a little endianness bug lurking around.
        }
      }

      Control control = new Control();
      Hasher controlSink = control.newHasher(1024);

      Iterable<Hasher> sinksAndControl =
          Iterables.concat(sinks, Collections.singleton(controlSink));

    val headers =
      Headers.headersOf(
        "cache-control",
        "no-store",
        "Cache-Control",
        "no-cache",
      )
    val headerMap = headers.toMultimap()
    assertThat(headerMap["cache-control"]!!.size).isEqualTo(2)
    assertThat(headerMap["Cache-Control"]!!.size).isEqualTo(2)
  }

        httpResponse.addHeader(ACCESS_CONTROL_ALLOW_ORIGIN, origin);
        httpResponse.addHeader(ACCESS_CONTROL_ALLOW_METHODS, fessConfig.getApiCorsAllowMethods());
        httpResponse.addHeader(ACCESS_CONTROL_ALLOW_HEADERS, fessConfig.getApiCorsAllowHeaders());
        httpResponse.addHeader(ACCESS_CONTROL_MAX_AGE, fessConfig.getApiCorsMaxAge());
        httpResponse.addHeader(ACCESS_CONTROL_ALLOW_CREDENTIALS, fessConfig.getApiCorsAllowCredentials());

    assertTrue(foo1.equals(foo1));
    assertEquals(control("foo", 1), foo1);
    assertEquals(control("bar", 2), entry("bar", 2));
    assertFalse(control("foo", 1).equals(entry("foo", 2)));
    assertFalse(foo1.equals(control("bar", 1)));
    assertFalse(foo1.equals(new Object()));
    assertFalse(foo1.equals(null));
  }

  public void testEqualsNull() {
    assertEquals(control(NK, 1), entry(NK, 1));

kube-system        coredns-5dd5756b68-mgjn9                             10.244.0.2  ambient-control-plane None                                TCP
kube-system        coredns-5dd5756b68-nzlpw                             10.244.0.3  ambient-control-plane None                                TCP
local-path-storage local-path-provisioner-6f8956fb48-vvnpn              10.244.0.4  ambient-control-plane None                                TCP