eventually someone will want to customize every one of those fields.
If all fields are exposed in `values.yaml`, we end up with an massive API that is also likely worse than just using the Kubernetes API directly.

To avoid this, the project attempts to minimize additions to the `values.yaml` API where possible.

  echo "Copying '${2}' to ${TARGET_OUT_LINUX}/ztunnel"
  cp -f "${2}" "${TARGET_OUT_LINUX}/ztunnel"
}

function maybe_build_ztunnel() {
  # TODO detect git changes or something to avoid unnecessarily building
  # BUILD_ZTUNNEL=1 with no BUILD_ZTUNNEL_REPO tries to infer BUILD_ZTUNNEL_REPO
  if [[ "${BUILD_ZTUNNEL_REPO:-}" == "" ]] && [[ "${BUILD_ZTUNNEL:-}" != "" ]]; then
    local ZTUNNEL_DIR

	// Instead, we track which UIDs we repaired and skip them if already repaired.
	//
	// An alternative would be to write something to the Pod (status, annotation, etc).
	// However, this requires elevated privileges we want to avoid
	if uid, f := c.repairedPods[key]; f {
		if uid == pod.UID {
			log.Debugf("Skipping pod, already repaired")
		} else {

  map<string, string> selector = 2;

  // label selector for pods that should match the replicas count. This is a serializated
  // version of both map-based and more expressive set-based selectors. This is done to
  // avoid introspection in the clients. The string will be in the same format as the
  // query-param syntax. If the target type only supports map-based selectors, both this
  // field and map-based selector field are populated.

lintconfig.gen.json
.istiorc
.istiorc.mk
# codegen stuff
bin/adapterlinter
bin/protoc-gen-gogoslick*
bin/protoc-min-version*
bin/protoc-gen-docs*
bin/testlinter
bin/envvarlinter
bin/istioctl
*.orig
# Avoid accidental istio.VERSION changes
istio.VERSION
LICENSES.txt
# Proxy generated proxy config in integration test
tests/integration/component/proxy/envoy.conf
**/var/run/secrets/
# Certs generated by testing

{{- /* Core defines the common configuration used by all webhook segments */}}
{{/* Copy just what we need to avoid expensive deepCopy */}}
{{- $whv := dict
 "revision" .Values.revision
  "injectionPath" .Values.istiodRemote.injectionPath
  "injectionURL" .Values.istiodRemote.injectionURL
  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
  "caBundle" .Values.istiodRemote.injectionCABundle
  "namespace" .Release.Namespace }}

}

func closeNetns(netns NetnsCloser) {
	netns.Close()
}

func (p *podNetnsCache) ReadCurrentPodSnapshot() map[string]WorkloadInfo {
	p.mu.RLock()
	defer p.mu.RUnlock()
	// snapshot the cache to avoid long locking
	return maps.Clone(p.currentPodCache)
}

// Remove and return the Netns for the given uid
// No need to return NetnsCloser here it will be closed automatically on GC.

    --version "${GRAFANA_VERSION}" \
    --repo https://grafana.github.io/helm-charts \
    -f "${WD}/values-grafana.yaml"

  # Set up grafana dashboards. Split into 2 and compress to single line json to avoid Kubernetes size limits
  compressDashboard "pilot-dashboard.json"
  compressDashboard "istio-performance-dashboard.json"
  compressDashboard "istio-workload-dashboard.json"
  compressDashboard "istio-service-dashboard.json"

{{- /* Core defines the common configuration used by all webhook segments */}}
{{/* Copy just what we need to avoid expensive deepCopy */}}
{{- $whv := dict
 "revision" .Values.revision
  "injectionPath" .Values.istiodRemote.injectionPath
  "injectionURL" .Values.istiodRemote.injectionURL
  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
  "caBundle" .Values.istiodRemote.injectionCABundle
  "namespace" .Release.Namespace }}

	}
	for _, pod := range s.pods.List(namespace, klabels.Everything()) {
		// ztunnel pods are never "added to/removed from the mesh", so do not fire
		// spurious events for them to avoid triggering extra
		// ztunnel node reconciliation checks.
		if !util.IsZtunnelPod(s.systemNamespace, pod) {
			log.Debugf("Enqueuing pod %s/%s", pod.Namespace, pod.Name)
			s.queue.Add(controllers.Event{
				New:   pod,