# If you explicitly told us where ztunnel lives, use that.
          # Otherwise, assume it lives in our namespace
          # Also, check for an explicit ENV override (legacy approach) and prefer that
          # if present
          {{ $ztTrustedNS := or .Values.pilot.trustedZtunnelNamespace .Release.Namespace }}
          {{- if not .Values.pilot.env.CA_TRUSTED_NODE_ACCOUNTS }}
          - name: CA_TRUSTED_NODE_ACCOUNTS

                                    type: string
                                  sni:
                                    description: SNI string to present to the server
                                      during TLS handshake.
                                    type: string
                                  subjectAltNames:

                                    type: string
                                  sni:
                                    description: SNI string to present to the server
                                      during TLS handshake.
                                    type: string
                                  subjectAltNames:

                  { \"a\", \"b\", \"c\", ... }  ->  true if the value of label X is
                  one of \"a\", \"b\", \"c\" \tlabel not in { \"a\", \"b\", \"c\",
                  ... }  ->  true if the value of label X is not one of \"a\", \"b\",
                  \"c\" \thas(label_name)  -> True if that label is present \t! expr

  - name: "ExternalNameServiceTypeInvalidPortName"
    code: IST0150
    level: Warning
    description: "Proxy may prevent tcp named ports and unmatched traffic for ports serving TCP protocol from being forwarded correctly for ExternalName services."
    template: "Port name for ExternalName service is invalid. Proxy may prevent tcp named ports and unmatched traffic for ports serving TCP protocol from being forwarded correctly"

                  This also means that the Gateway must have at least one non-conflicting
                  Listener in this case, otherwise it violates the requirement that at
                  least one Listener must be present.


                  The implementation MUST set a "ListenersNotValid" condition on the
                  Gateway Status when the Gateway contains Conflicted Listeners whether or