path: istio-token
      - name: cacerts
        secret:
          optional: true
          secretName: cacerts
      - name: istio-kubeconfig
        secret:
          optional: true
          secretName: istio-kubeconfig
      - name: istio-csr-dns-cert
        secret:
          optional: true
          secretName: istiod-tls
      - configMap:
          defaultMode: 420

		/apiserver      Generates an API server serving certificate and key
		...
	kubeconfig		Generates all kubeconfig files necessary to establish the control plane
		/admin          Generates a kubeconfig file for the admin to use and for kubeadm itself
		/kubelet        Generates a kubeconfig file for the kubelet to use.
		...
	...

			cmd.SetArgs(allFlags)
			if err := cmd.Execute(); err != nil {
				t.Fatalf("Could not execute subcommand: %v", err)
			}

			// reads kubeconfig written to stdout
			config, err := clientcmd.Load(buf.Bytes())
			if err != nil {
				t.Fatalf("couldn't read kubeconfig file from buffer: %v", err)
			}

			// checks that CLI flags are properly propagated

	}

	if kp.config.ClientConnection.Kubeconfig == "" {
		kp.config.ClientConnection.Kubeconfig = kubeproxyKubeConfigFileName
	} else if kp.config.ClientConnection.Kubeconfig != kubeproxyKubeConfigFileName {
		warnDefaultComponentConfigValue(kind, "clientConnection.kubeconfig", kubeproxyKubeConfigFileName, kp.config.ClientConnection.Kubeconfig)
	}
}

// Mutate is NOP for the kube-proxy config

{
  "cniVersion": "0.3.1",
  "name": "istio-cni",
  "type": "prefix-istio-cni",
  "plugin_log_level": "debug",
  "kubernetes": {
      "kubeconfig": "/path/to/kubeconfig",
      "cni_bin_dir": "/path/cni/bin"
  }

    {
      "ambient_enabled": false,
      "cni_event_address": "",
      "dns": {},
      "ipam": {},
      "kubernetes": {
        "exclude_namespaces": [
          ""
        ],
        "kubeconfig": "/path/to/kubeconfig"
      },
      "log_uds_address": "",
      "name": "istio-cni",
      "plugin_log_level": "debug",
      "type": "istio-cni"
    }
  ]

	if len(config.Clusters) < 1 {
		return nil, errors.New("the provided kubeconfig file must have at least one Cluster defined")
	}
	currentClusterName, currentCluster := kubeconfigutil.GetClusterFromKubeConfig(config)
	if currentCluster == nil {
		return nil, errors.New("the provided kubeconfig file must have a unnamed Cluster or a CurrentContext that specifies a non-nil Cluster")
	}

      "plugin_log_level": "info",
      "mtu": 1500,
      "ipam": {
        "type": "calico-ipam"
      },
      "policy": {
        "type": "k8s"
      },
      "kubernetes": {
        "kubeconfig": "/etc/cni/net.d/calico-kubeconfig"
      }
    },
    {
      "type": "portmap",
      "snat": true,
      "capabilities": {
        "portMappings": true
      }
    }
  ]

	"istio.io/istio/pkg/kube"
)

const (
	defaultTimeoutDurationStr = "10m"
)

// New creates a rest.Config and Clientset from the given kubeconfig path and Context.
func New(kubeconfig, kubeContext string) (*rest.Config, *kubernetes.Clientset, error) {
	clientConfig := kube.BuildClientCmd(kubeconfig, kubeContext, func(co *clientcmd.ConfigOverrides) {
		co.Timeout = defaultTimeoutDurationStr
	})
	restConfig, err := clientConfig.ClientConfig()

              path: istio-token
      - name: cacerts
        secret:
          optional: true
          secretName: cacerts
      - name: istio-kubeconfig
        secret:
          optional: true
          secretName: istio-kubeconfig
      - name: istio-csr-dns-cert
        secret:
          optional: true
          secretName: istiod-tls
      - configMap:
          defaultMode: 420