function maybe_build_ztunnel() {
  # TODO detect git changes or something to avoid unnecessarily building
  # BUILD_ZTUNNEL=1 with no BUILD_ZTUNNEL_REPO tries to infer BUILD_ZTUNNEL_REPO
  if [[ "${BUILD_ZTUNNEL_REPO:-}" == "" ]] && [[ "${BUILD_ZTUNNEL:-}" != "" ]]; then
    local ZTUNNEL_DIR
	ZTUNNEL_DIR="$(pwd)/../ztunnel"
    if [[ -d "${ZTUNNEL_DIR}" ]]; then
      BUILD_ZTUNNEL_REPO="${ZTUNNEL_DIR}"
    else
      echo "No directory at ${ZTUNNEL_DIR}"

In ambient mode, the CNI plugin is effectively just a shim to catch pod creation events and notify the CNI agent early enough to set up network redirection before the pod is fully started. This is necessary because the CNI plugin is effectively the first thing to see a scheduled pod - before the K8S control plane will see things like the pod IP or networking info, the CNI will - but the CNI plugin alone is not sufficient to handle all pod events (already-started...

  optional int32 availableReplicas = 11;
}

// StatefulSetUpdateStrategy indicates the strategy that the StatefulSet
// controller will use to perform updates. It includes any additional parameters
// necessary to perform the update for the indicated strategy.
message StatefulSetUpdateStrategy {
  // Type indicates the type of the StatefulSetUpdateStrategy.
  // Default is RollingUpdate.
  // +optional

  # Download and extract the Envoy linux debug binary.
  download_envoy_if_necessary "${ISTIO_ENVOY_LINUX_DEBUG_URL}" "$ISTIO_ENVOY_LINUX_DEBUG_PATH" "${SIDECAR}"
else
  echo "Skipping envoy debug. Set DEBUG_IMAGE to download."
fi

# Download and extract the Envoy linux release binary.
download_envoy_if_necessary "${ISTIO_ENVOY_LINUX_RELEASE_URL}" "$ISTIO_ENVOY_LINUX_RELEASE_PATH" "${SIDECAR}"

        its Contributions.

     This License does not grant any rights in the trademarks, service marks,
     or logos of any Contributor (except as may be necessary to comply with
     the notice requirements in Section 3.4).

2.4. Subsequent Licenses

     No Contributor makes additional grants as a result of Your choice to

Istio has strong integration with certmanager.  Some operators may want to keep their current certmanager
CRDs in place and not have Istio modify them. In this case, it is necessary to apply CRD files individually.

```bash
kubectl apply -k github.com/istio/installer/base
```

or

```bash
kubectl apply -f base/files
```

### Install Istio-CNI

message VolumeAttachmentSource {
  // persistentVolumeName represents the name of the persistent volume to attach.
  // +optional
  optional string persistentVolumeName = 1;

  // inlineVolumeSpec contains all the information necessary to attach
  // a persistent volume defined by a pod's inline VolumeSource. This field
  // is populated only for the CSIMigration feature. It contains
  // translated fields from a pod's inline VolumeSource to a

  //
  // +optional
  optional string fsGroupPolicy = 5;

  // tokenRequests indicates the CSI driver needs pods' service account
  // tokens it is mounting volume for to do necessary authentication. Kubelet
  // will pass the tokens in VolumeContext in the CSI NodePublishVolume calls.
  // The CSI driver should parse and validate the following VolumeContext:
  // "csi.storage.k8s.io/serviceAccount.tokens": {

CRDs are separated by release and by component type in the CRD directory. Istio has strong integration with certmanager. Some operators may want to keep their current certmanager CRDs in place and not have Istio modify them. In this case, it is necessary to apply CRD files individually. ```bash kubectl apply -k github.com/istio/installer/base ``` or ```bash kubectl apply -f base/files ``` ### Install Istio-CNI This is an optional step - CNI must run in a dedicated namespace, it is a 'singleton' and...

  //
  // +optional
  optional string fsGroupPolicy = 5;

  // tokenRequests indicates the CSI driver needs pods' service account
  // tokens it is mounting volume for to do necessary authentication. Kubelet
  // will pass the tokens in VolumeContext in the CSI NodePublishVolume calls.
  // The CSI driver should parse and validate the following VolumeContext:
  // "csi.storage.k8s.io/serviceAccount.tokens": {