certificate provisioning tool, or use components that are centrally managed and running in a different cluster.

This is a work in progress - building on top of the multi-cluster installer.

As an extreme, the goal is to be possible to run Istio workloads in a cluster without installing any Istio component
in that cluster. Currently, the minimum we require is the security provider (node agent or citadel).

### Install Istio CRDs

/*
 [Crawler Notification]
*/
subject: [FESS] Status Change: /*pmb.hostname:orElse('Unknown')*/
>>>
--- Server Info ---
Cluster Name: /*pmb.clustername:orElse('Unknown')*/
Host Name: /*pmb.hostname:orElse('Unknown')*/

--- Status ---

  --advertise-client-urls http://0.0.0.0:2379 \
  --listen-peer-urls http://0.0.0.0:2380 \
  --initial-advertise-peer-urls http://0.0.0.0:2380 \
  --initial-cluster s1=http://0.0.0.0:2380 \
  --initial-cluster-token tkn \
  --initial-cluster-state new
```

You may also setup etcd with TLS following this documentation [here](https://coreos.com/etcd/docs/latest/op-guide/security.html)

### 3. Setup MinIO with etcd

// Package-wide variables from generator "generated".
option go_package = "k8s.io/api/certificates/v1alpha1";

// ClusterTrustBundle is a cluster-scoped container for X.509 trust anchors
// (root certificates).
//
// ClusterTrustBundle objects are considered to be readable by any authenticated
// user in the cluster, because they can be mounted by pods using the
// `clusterTrustBundle` projection.  All service accounts have read access to

[
    {
        "clusterName": "outbound|80||istio-ingressgateway.istio-system.svc.cluster.local",
        "endpoints": [
            {
                "locality": {},
                "lbEndpoints": [
                    {
                        "endpoint": {
                            "address": {
                                "socketAddress": {
                                    "address": "10.244.0.176",

- clusterName: outbound|80||istio-ingressgateway.istio-system.svc.cluster.local
  endpoints:
  - lbEndpoints:
    - endpoint:
        address:
          socketAddress:
            address: 10.244.0.176
            portValue: 8080
        healthCheckConfig: {}
      healthStatus: HEALTHY
      loadBalancingWeight: 1
      metadata:
        filterMetadata:
          istio:

 public:
  virtual ~ImmediateExecutionDistributedManager() {}

  // Set up distributed execution environment on local and remote tasks.
  // When `reset_context` is true, initialize new cluster context state based
  // on cluster configurations provided in `server_def`; otherwise, update
  // existing context state with the provided `server_def`. Contexts created
  // on remote tasks will be considered stale and garbage collected after

        "domains": [
         "*"
        ],
        "routes": [
         {
          "match": {
           "prefix": "/healthz/ready"
          },
          "route": {
           "cluster": "agent"
          }
         }
        ]
       }
      ]
     },
     "last_updated": "2023-11-29T09:58:27.299Z"
    },
    {
     "route_config": {

Cluster level Replication metrics can be viewed in the Grafana dashboard using [json file here](https://raw.githubusercontent.com/minio/minio/master/docs/metrics/prometheus/grafana/replication/minio-replication-cluster.json)

![Grafana](https://raw.githubusercontent.com/minio/minio/master/docs/metrics/prometheus/grafana/replication/grafana-replication-cluster.png)

of Pilot replicas is a component setting, because it refers to a component which is a Deployment in the
cluster. Most K8s platform settings are necessarily component settings.
The available features and the components that comprise each feature are as follows:

| Feature | Components |
|---------|------------|
CRDs, and other cluster wide configs | Base
Traffic Management | Pilot
Security | Pilot
Configuration management | Pilot