controller as the CLI command `istioctl install` running in a loop in a pod in the cluster and using the config
from the in-cluster IstioOperator custom resource (CR).
There are two major differences:

1. The controller does not accept any dynamic user config through flags. All user interaction is through the
IstioOperator CR.
1. The controller has additional logic that mirrors istioctl commands like upgrade, but is driven from the declarative

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  components:
    base:
      enabled: true
    ingressGateways:
      - namespace: istio-system
        name: istio-ingressgateway
        enabled: false
        k8s:
          service:

}

// InstallManifests generates manifests from the given istiooperator instance and applies them to the
// cluster. See GenManifests for more description of the manifest generation process.
//
//	force   validation warnings are written to logger but command is not aborted
//	DryRun  all operations are done but nothing is written
//
// Returns final IstioOperator after installation if successful.

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  components:
    pilot:
      enabled: false
    ingressGateways:
      - namespace: istio-system
        name: istio-ingressgateway
        enabled: true
        k8s:
          service:
            externalTrafficPolicy: Local
          serviceAnnotations:

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:

	CRMergeFailureTotal = monitoring.NewSum(
		"cr_merge_failure_total",
		"Number of IstioOperator CR merge failures",
	)

	// CRDeletionTotal counts the number of times
	// IstioOperator CR was deleted.
	CRDeletionTotal = monitoring.NewSum(
		"cr_deletion_total",
		"Number of IstioOperator CR deleted",
	)

	// CRValidationErrorTotal counts the number of CR
	// validation failures.

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  profile: empty
  components:
    pilot:

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  values:
    gateways:
      istio-egressgateway:

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  components:
    base:
      enabled: false
    ingressGateways:
      - enabled: true
        label:
          api: default
          foo: bar
        k8s:
          service:
            externalTrafficPolicy: Test
          serviceAnnotations:
            manifest-generate: testserviceAnnotation
        name: istio-ingressgateway
        namespace: istio-system

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  meshConfig:
    extensionProviders:
      - name: otel
        envoyOtelAls:
          service: opentelemetry-collector.istio-system.svc.cluster.local
          port: 4317
          logFormat:
            labels:
              pod: "%ENVIRONMENT(POD_NAME)%"
              namespace: "%ENVIRONMENT(POD_NAMESPACE)%"
              cluster: "%ENVIRONMENT(ISTIO_META_CLUSTER_ID)%"