defaultTemplates: [sidecar]
    policy: enabled
    alwaysInjectSelector:
      []
    neverInjectSelector:
      []
    injectedAnnotations:
    template: "{{ Template_Version_And_Istio_Version_Mismatched_Check_Installation }}"
    templates:
      sidecar: |
        {{- define "resources"  }}

However, this happens before # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify: # injectedAnnotations: # container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default # container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default injectedAnnotations: {} # This enables injection of sidecar in all namespaces, # with the exception of namespaces with "istio-injection:disabled" annotation # Only one environment...