if (!containsModule(moduleName)) {
                    /*
                     * Not patching an existing module. This case should be unusual. If it nevertheless
                     * happens, add on class-path or module-path if allowed, or keep patching otherwise.
                     * The latter case (keep patching) is okay if the main module will be defined later.
                     */

          - extensions.istio.io
        apiVersions:
          - "*"
        resources:
          - "*"

    {{- if .Values.base.validationCABundle }}
    # Disable webhook controller in Pilot to stop patching it
    failurePolicy: Fail
    {{- else }}
    # Fail open until the validation webhook is ready. The webhook controller
    # will update this to `Fail` and patch in the `caBundle` when the webhook
    # endpoint is ready.

          - extensions.istio.io
        apiVersions:
          - "*"
        resources:
          - "*"

    {{- if .Values.base.validationCABundle }}
    # Disable webhook controller in Pilot to stop patching it
    failurePolicy: Fail
    {{- else }}
    # Fail open until the validation webhook is ready. The webhook controller
    # will update this to `Fail` and patch in the `caBundle` when the webhook
    # endpoint is ready.

          - extensions.istio.io
        apiVersions:
          - "*"
        resources:
          - "*"
    {{- if .Values.base.validationCABundle }}
    # Disable webhook controller in Pilot to stop patching it
    failurePolicy: Fail
    {{- else }}
    # Fail open until the validation webhook is ready. The webhook controller
    # will update this to `Fail` and patch in the `caBundle` when the webhook
    # endpoint is ready.

          - extensions.istio.io
        apiVersions:
          - "*"
        resources:
          - "*"
    {{- if .Values.base.validationCABundle }}
    # Disable webhook controller in Pilot to stop patching it
    failurePolicy: Fail
    {{- else }}
    # Fail open until the validation webhook is ready. The webhook controller
    # will update this to `Fail` and patch in the `caBundle` when the webhook
    # endpoint is ready.

					})
				election.Run(clusterStopCh)
				return nil
			})
		}
		// Set up injection webhook patching for remote clusters we are controlling.
		// The config cluster has this patching set up elsewhere. We may eventually want to move it here.
		// We can not use leader election for webhook patching because each revision needs to patch its own
		// webhook.
		if shouldLead && !configCluster && m.caBundleWatcher != nil {

{{ $pilotVals := pick .Values.pilot "cni" -}}
{{ $vals = set $vals "pilot" $pilotVals -}}
{{ $vals | toPrettyJson | indent 4 }}

  # To disable injection: use omitSidecarInjectorConfigMap, which disables the webhook patching
  # and istiod webhook functionality.
  #
  # New fields should not use Values - it is a 'primary' config object, users should be able
  # to fine tune it or use it with kube-inject.
  config: |-

{{ $pilotVals := pick .Values.pilot "cni" -}}
{{ $vals = set $vals "pilot" $pilotVals -}}
{{ $vals | toPrettyJson | indent 4 }}

  # To disable injection: use omitSidecarInjectorConfigMap, which disables the webhook patching
  # and istiod webhook functionality.
  #
  # New fields should not use Values - it is a 'primary' config object, users should be able
  # to fine tune it or use it with kube-inject.
  config: |-

	WatchedNamespace string

	// File path to the x509 certificate bundle used by the webhook server
	// and patched into the webhook config.
	CABundleWatcher *keycertbundle.Watcher

	// Revision for control plane performing patching on the validating webhook.
	Revision string

	// Name of the service running the webhook server.
	ServiceName string
}

// Validate the options that exposed to end users
func (o Options) Validate() error {

	test.TestWatch(
		validController,
		// matching labels
		[]labels.Set{
			{"a": "b"},
		},
		// not matching labels
		[]labels.Set{
			{"a": "c"},
			{"foo": "bar"},
		},
		// matching fields
		[]fields.Set{
			{"status.replicas": "0"},
			{"metadata.name": "foo"},
			{"status.replicas": "0", "metadata.name": "foo"},
		},
		// not matching fields
		[]fields.Set{