resources: ["validatingwebhookconfigurations"]
    verbs: ["get", "list", "watch", "update"]

  # istio configuration
  # removing CRD permissions can break older versions of Istio running alongside this control plane (https://github.com/istio/istio/issues/29382)
  # please proceed with caution

metadata:
  {{- if .Values.pilot.enabled }}
  # when local istiod is enabled, we can't use istiod service name to reach the remote control plane
  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}-remote
  {{- else }}
  # when local istiod isn't enabled, we can use istiod service name to reach the remote control plane
  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
  {{- end }}
  namespace: {{ .Release.Namespace }}

defaults:
  global:

    # ImagePullSecrets for control plane ServiceAccount, list of secrets in the same namespace
    # to use for pulling any images in pods that reference this ServiceAccount.
    # Must be set for any cluster configured with private docker registry.
    imagePullSecrets: []

    # Used to locate istiod.
    istioNamespace: istio-system

    externalIstiod: false
    remotePilotAddress: ""

    id: gopls-version
    attributes:
      label: "gopls version"
      description: "Output of `gopls -v version` on the command line"
    validations:
      required: true
  - type: textarea
    id: go-env
    attributes:
      label: "go env"
      description: "Output of `go env` on the command line in your workspace directory"
      render: shell
    validations:
      required: true
  - type: textarea

  # Zipkin trace collector
  zipkinAddress: ""
  #
  # Statsd metrics collector converts statsd metrics into Prometheus metrics.
  statsdUdpAddress: ""
  #
  # Mutual TLS authentication between sidecars and istio control plane.
  controlPlaneAuthPolicy: NONE
  #
  # Address where istio Pilot service is running

    resources: ["validatingwebhookconfigurations"]
    verbs: ["get", "list", "watch", "update"]

  # istio configuration
  # removing CRD permissions can break older versions of Istio running alongside this control plane (https://github.com/istio/istio/issues/29382)
  # please proceed with caution

          # the end of the line.
          # See https://cloud.google.com/architecture/using-container-images#exploring_image_manifests_digests_and_tags
          echo -n "Trying to map name $1 to tag $2... "
          digest=$(curl -s --head "https://gcr.io/v2/tensorflow-sigs/build/manifests/$2" | egrep -o "sha256:[[:alnum:]]*")
          # Find the line matching the regex "sigbuild-r2.9" (with quotes) and

        with:
          results_file: results.sarif
          results_format: sarif
          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
          # - you want to enable the Branch-Protection check on a *public* repository, or
          # - you are installing Scorecard on a *private* repository

metadata:
  {{- if .Values.pilot.enabled }}
  # when local istiod is enabled, we can't use istiod service name to reach the remote control plane
  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}-remote
  {{- else }}
  # when local istiod isn't enabled, we can use istiod service name to reach the remote control plane
  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
  {{- end }}
  namespace: {{ .Release.Namespace }}

      align: start
      color: *color
      line:
        amount: 3
        height: 1.25
      font:
        family: *font_family
        style: Bold

  # Page description
  - size: { width: 832, height: 64 }
    offset: { x: 64, y: 512 }
    typography:
      content: *page_description
      align: start
      color: *color
      line:
        amount: 2
        height: 1.5
      font: