de class=language-bash data-expandlinks=true data-repo=istio>$ cat &lt;&lt;EOF &gt; ./istio.yaml
  apiVersion: install.istio.io/v1alpha1
  kind: IstioOperator
  spec:
    pilot:
      k8s:
        env:
        # Indicate to Istiod that we use an Custom Certificate Authority
        - name: EXTERNAL_CA
          value: ISTIOD_RA_KUBERNETES_API
        # Tells Istiod to use the Kubernetes legacy CA Signer
        - name: K8S_SIGNER
          value: kubernetes.io/legacy-unknown
  EOF
$ istioctl install --set p