stio/istio/issues/43585>Issue #43585</a>)</p></li><li><p><strong>Added</strong> check to limit the <code>clusterrole</code> for k8s CSR permissions for
external CA <code>usecases</code> by verifying <code>.Values.pilot.env.EXTERNAL_CA</code> and <code>.Values.global.pilotCertProvider</code> parameters.</p></li><li><p><strong>Added</strong> configurable node affinity to istio-cni <code>values.yaml</code>. Can be used to allow excluding istio-cni from being scheduled on specific nodes.</p></li><li><p><strong>