# This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
    #
    # annotations:
    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
    #
    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before

    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
    #
    # annotations:
    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
    #
    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before

bel.tr belau.pw belem.br bellevue.museum belluno.it benevento.it bentley beppu.oita.jp berg.no bergamo.it bergbau.museum bergen.no berkeley.museum berlevag.no berlevåg.no berlin berlin.museum bern.museum beskidy.pl best bestbuy bet bet.ar beta.bounty-full.com beta.tailscale.net betainabox.com better-than.tv bf bg bg.eu.org bg.it bh bharti bhz.br bi bi.it bialowieza.pl bialystok.pl bib.br bib.ve bibai.hokkaido.jp bible bible.museum bid biei.hokkaido.jp bielawa.pl biella.it bieszczady.pl bievat.no bievát.no...

`networkPolicy.enabled` to `true`. For Kubernetes v1.5 & v1.6, you must also turn on NetworkPolicy by setting the DefaultDeny namespace annotation. Note: this will enforce policy for *all* pods in the namespace: ``` kubectl annotate namespace default "net.beta.kubernetes.io/network-policy={\"ingress\":{\"isolation\":\"DefaultDeny\"}}" ``` With NetworkPolicy enabled, traffic will be limited to just port 9000. For more precise policy, set `networkPolicy.allowExternal=true`. This will only allow pods with the...

`networkPolicy.enabled` to `true`. For Kubernetes v1.5 & v1.6, you must also turn on NetworkPolicy by setting the DefaultDeny namespace annotation. Note: this will enforce policy for *all* pods in the namespace: ``` kubectl annotate namespace default "net.beta.kubernetes.io/network-policy={\"ingress\":{\"isolation\":\"DefaultDeny\"}}" ``` When using `Cilium` as a CNI in your cluster, please edit the `flavor` field to `cilium`. With NetworkPolicy enabled, traffic will be limited to just port 9000. For more...

    {{- end }}
    - name: ISTIO_META_APP_CONTAINERS
      value: "{{ $containers | join "," }}"
    - name: ISTIO_META_CLUSTER_ID
      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
    - name: ISTIO_META_NODE_NAME
      valueFrom:
        fieldRef:
          fieldPath: spec.nodeName
    - name: ISTIO_META_INTERCEPTION_MODE

        - name: ISTIO_META_NETWORK
          value: {{.|quote}}
        {{- end }}
        - name: ISTIO_META_WORKLOAD_NAME
          value: {{.DeploymentName|quote}}
        - name: ISTIO_META_OWNER
          value: "kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}"
        {{- if .Values.global.meshID }}
        - name: ISTIO_META_MESH_ID

          {{- $network_set := index $gateway.env "ISTIO_META_NETWORK" }}
          {{- if and (not $network_set) .Values.global.network }}
          - name: ISTIO_META_NETWORK
            value: "{{ .Values.global.network }}"
          {{- end }}
          - name: ISTIO_META_CLUSTER_ID
            value: "{{ $.Values.global.multiCluster.clusterName | default `Kubernetes` }}"
          - name: ISTIO_META_NODE_NAME
            valueFrom:

# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
meshConfig:
  defaultConfig:
    proxyMetadata:
      ISTIO_META_ENABLE_HBONE: "true"
global:
  variant: distroless
pilot:
  env:
    PILOT_ENABLE_AMBIENT: "true"
    CA_TRUSTED_NODE_ACCOUNTS: "istio-system/ztunnel,kube-system/ztunnel"
cni:
  ambient:
    enabled: true

# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
meshConfig:
  defaultConfig:
    proxyMetadata:
      ISTIO_META_ENABLE_HBONE: "true"
global:
  variant: distroless
pilot:
  env:
    PILOT_ENABLE_AMBIENT: "true"
    CA_TRUSTED_NODE_ACCOUNTS: "istio-system/ztunnel,kube-system/ztunnel"
cni:
  ambient:
    enabled: true