name: istiod
        {{- else }}
        name: istiod-{{ .Values.defaultRevision }}
        {{- end }}
        namespace: {{ .Values.global.istioNamespace }}
        path: "/validate"
      {{- end }}
      {{- if .Values.base.validationCABundle }}
      caBundle: "{{ .Values.base.validationCABundle }}"
      {{- end }}
    rules:
      - operations:
          - CREATE
          - UPDATE

defaults:
  global:
    # Used to locate istiod.
    istioNamespace: "istio-system"

  base:
    # Validation webhook configuration url
    # For example: https://$remotePilotAddress:15017/validate
    validationURL: ""

  istiodRemote:
    # Sidecar injector mutating webhook configuration url
    # For example: https://$remotePilotAddress:15017/inject
    injectionURL: ""

## Step 3. Update istioctl schema

Istioctl uses a [schema](../../operator/pkg/apis/istio/v1alpha1/values_types.proto) to validate the values. Any changes to
the schema must be added here, otherwise istioctl users will see errors.
Once the schema file is updated, run:

```bash
$ make operator-proto
```

          },
          "name": "default.http.0"
         }
        ],
        "include_request_attempt_count": true
       }
      ],
      "validate_clusters": false,
      "max_direct_response_body_size_bytes": 1048576,
      "ignore_port_in_host_matching": true
     },
     "last_updated": "2023-11-29T09:58:27.570Z"
    }
   ]
  }
 ]

  // trust between the target audiences.
  repeated string audiences = 1;

  // ExpirationSeconds is the requested duration of validity of the request. The
  // token issuer may return a token with a different validity duration so a
  // client needs to check the 'expiration' field in a response.
  // +optional
  optional int64 expirationSeconds = 4;

    ipFamilies: []

  base:
    # Used for helm2 to add the CRDs to templates.
    enableCRDTemplates: false

    # Validation webhook configuration url
    # For example: https://$remotePilotAddress:15017/validate
    validationURL: ""
    # Validation webhook caBundle value. Useful when running pilot with a well known cert
    validationCABundle: ""

    # For istioctl usage to disable istio config crds in base

  // identifier in the intersection of the TokenReviewSpec audiences and the
  // token's audiences. A client of the TokenReview API that sets the
  // spec.audiences field should validate that a compatible audience identifier
  // is returned in the status.audiences field to ensure that the TokenReview
  // server is audience aware. If a TokenReview returns an empty

      {{- else }}
      service:
        name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
        namespace: {{ .Values.global.istioNamespace }}
        path: "/validate"
      {{- end }}
    rules:
      - operations:
          - CREATE
          - UPDATE
        apiGroups:
          - security.istio.io
          - networking.istio.io
          - telemetry.istio.io

        name: istiod
        {{- else }}
        name: istiod-{{ .Values.defaultRevision }}
        {{- end }}
        namespace: {{ .Values.global.istioNamespace }}
        path: "/validate"
      {{- end }}
      {{- if .Values.base.validationCABundle }}
      caBundle: "{{ .Values.base.validationCABundle }}"
      {{- end }}
    rules:
      - operations:
          - CREATE
          - UPDATE

		t.Fatalf("failed with error: %v", err)
	}
}

func buildFakeDryRunPod() *corev1.Pod {
	app := corev1.Container{Name: "test"}
	proxy := corev1.Container{Name: "istio-proxy"}
	validate := corev1.Container{Name: "istio-validate"}
	fakePod := &corev1.Pod{
		TypeMeta: metav1.TypeMeta{
			APIVersion: "core/v1",
			Kind:       "Pod",
		},
		ObjectMeta: metav1.ObjectMeta{
			Name:        testPodName,