{{ $mcsAPIGroup := or .Values.pilot.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
  labels:
    app: istio-reader
    release: {{ .Release.Name }}
rules:
  - apiGroups:
      - "config.istio.io"
      - "security.istio.io"
      - "networking.istio.io"

function download_ztunnel_if_necessary () {
  if [[ -f "$2" ]]; then
    return
  fi
  # Enter the output directory.
  mkdir -p "$(dirname "$2")"
  pushd "$(dirname "$2")"

  # Download and make the binary executable
  echo "Downloading ztunnel: $1 to $2"
  time ${DOWNLOAD_COMMAND} --header "${AUTH_HEADER:-}" "$1" > "$2"
  chmod +x "$2"

                            type: string
                          header:
                            description: The name of the header to be created.
                            type: string
                        type: object
                      type: array
                    outputPayloadToHeader:
                      description: This field specifies the header name to output

// Copyright Istio Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,

                                    "max_stream_duration": {
                                      "max_stream_duration": "0s",
                                      "grpc_timeout_header_max": "0s"
                                    }
                                  },
                                  "decorator": {
                                    "operation": ":8000/*"

/*
Copyright The Kubernetes Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,

// Copyright Istio Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,

      "links": [],
      "options": {
        "code": {
          "language": "plaintext",
          "showLineNumbers": false,
          "showMiniMap": false
        },
        "content": "<div class=\"dashboard-header text-center\">\n<span>SERVICE: $service</span>\n</div>",
        "mode": "html"
      },
      "pluginVersion": "10.1.5",
      "transparent": true,
      "type": "text"
    },
    {
      "datasource": {

                                    "max_stream_duration": {
                                      "max_stream_duration": "0s",
                                      "grpc_timeout_header_max": "0s"
                                    }
                                  },
                                  "decorator": {
                                    "operation": ":9080/*"

# This service account aggregates reader permissions for the revisions in a given cluster
# Should be used for remote secret creation.
apiVersion: v1
kind: ServiceAccount
  {{- if .Values.global.imagePullSecrets }}
imagePullSecrets:
  {{- range .Values.global.imagePullSecrets }}
  - name: {{ . }}
    {{- end }}
    {{- end }}
metadata:
  name: istio-reader-service-account
  namespace: {{ .Values.global.istioNamespace }}
  labels: