istiod:
      enableAnalysis: false

    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
    logAsJson: false

    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
    # The control plane has different scopes depending on component, but can configure default log level across all components

  // MaxSkew describes the degree to which pods may be unevenly distributed.
  // When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference
  // between the number of matching pods in the target topology and the global minimum.
  // The global minimum is the minimum number of matching pods in an eligible domain
  // or zero if the number of eligible domains is less than MinDomains.

  // The maximum number of nodes with an existing available DaemonSet pod that
  // can have an updated DaemonSet pod during during an update.
  // Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).
  // This can not be 0 if MaxUnavailable is 0.
  // Absolute number is calculated from percentage by rounding up to a minimum of 1.
  // Default value is 0.

  //
  // The minimum valid value for expirationSeconds is 600, i.e. 10 minutes.
  //
  // +optional
  optional int32 expirationSeconds = 8;

  // usages specifies a set of key usages requested in the issued certificate.
  //
  // Requests for TLS client certificates typically request: "digital signature", "key encipherment", "client auth".
  //

                      "common_tls_context": {
                        "tls_params": {
                          "tls_minimum_protocol_version": "TLSv1_3",
                          "tls_maximum_protocol_version": "TLSv1_3"
                        },
                        "alpn_protocols": [
                          "h2"
                        ],

	if err != nil {
		return nil, nil, err
	}
	if err := k8sversion.IsK8VersionSupported(kubeClient, l); err != nil {
		return nil, nil, fmt.Errorf("check minimum supported Kubernetes version: %v", err)
	}
	return kubeClient, client, nil
}

// applyOptions contains the startup options for applying the manifest.
type applyOptions struct {
	// Path to the kubeconfig file.

	pkgVersion "istio.io/istio/pkg/version"
)

const (
	// MinK8SVersion is the minimum k8s version required to run this version of Istio
	// https://istio.io/docs/setup/platform-setup/
	MinK8SVersion               = 26
	UnSupportedK8SVersionLogMsg = "\nThe Kubernetes version %s is not supported by Istio %s. The minimum supported Kubernetes version is 1.%d.\n" +
		"Proceeding with the installation, but you might experience problems. " +

           "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext",
           "common_tls_context": {
            "tls_params": {
             "tls_minimum_protocol_version": "TLSv1_2",
             "tls_maximum_protocol_version": "TLSv1_3",
             "cipher_suites": [
              "ECDHE-ECDSA-AES256-GCM-SHA384",
              "ECDHE-RSA-AES256-GCM-SHA384",

  // The maximum number of nodes with an existing available DaemonSet pod that
  // can have an updated DaemonSet pod during during an update.
  // Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).
  // This can not be 0 if MaxUnavailable is 0.
  // Absolute number is calculated from percentage by rounding up to a minimum of 1.
  // Default value is 0.

                    "common_tls_context": {
                      "tls_params": {
                        "tls_minimum_protocol_version": "TLSv1_2",
                        "tls_maximum_protocol_version": "TLSv1_3"
                      },
                      "alpn_protocols": [
                        "istio-peer-exchange",
                        "istio"