CA_TRUSTED_NODE_ACCOUNTS: "istio-system/ztunnel,kube-system/ztunnel" PILOT_ENABLE_AMBIENT_CONTROLLERS: "true" cni: logLevel: info privileged: true ambient: enabled: true # Default excludes istio-system; its actually fine to redirect there since we opt-out istiod, ztunnel, and istio-cni excludeNamespaces: - kube-system manifests/charts/default/Chart.yaml apiVersion: v1 name: istio-default # This version is never actually shipped. istio/release-builder will replace it at build-time # with the appropriate...