- "certificatesigningrequests/approval"
      - "certificatesigningrequests/status"
    verbs: ["update", "create", "get", "delete", "watch"]
  - apiGroups: ["certificates.k8s.io"]
    resources:
      - "signers"
    resourceNames:
    - "kubernetes.io/legacy-unknown"
{{- range .Values.global.certSigners }}
    - {{ . | quote }}
{{- end }}
    verbs: ["approve"]
{{- end}}

  # Used by Istiod to verify the JWT tokens

      - tutorial/security/simple-oauth2.md
      - tutorial/security/oauth2-jwt.md
    - tutorial/middleware.md
    - tutorial/cors.md
    - tutorial/sql-databases.md
    - tutorial/bigger-applications.md
    - tutorial/background-tasks.md
    - tutorial/metadata.md
    - tutorial/static-files.md
    - tutorial/testing.md
    - tutorial/debugging.md
  - Advanced User Guide:

# See the License for the specific language governing permissions and
# limitations under the License.
# ============================================================================

on:
  workflow_dispatch:  # Allow manual triggers
  schedule:
    - cron: 0 4 * * *  # 4am UTC is 9pm PDT and 8pm PST
name: Set nightly branch to master HEAD

permissions: {}

jobs:
  master-to-nightly:

  meshConfig:
    enablePrometheusMerge: true

  global:
    # Used to locate istiod.
    istioNamespace: istio-system
    # List of cert-signers to allow "approve" action in the istio cluster role
    #
    # certSigners:
    #   - clusterissuers.cert-manager.io/istio-ca
    certSigners: []

including Istiod and istio-agent behavior # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options meshConfig: enablePrometheusMerg: true global: # Used to locate istiod. istioNamespace: istio-system # List of cert-signers to allow "approve" action in the istio cluster role # # certSigners: # - clusterissuers.cert-manager.io/istio-ca certSigners: [] # enable pod disruption budget for the control plane, which is used to # ensure Istio control plane components are gradually...

  meshConfig:
    enablePrometheusMerge: true
  global:
    # Used to locate istiod.
    istioNamespace: istio-system
    # List of cert-signers to allow "approve" action in the istio cluster role
    #
    # certSigners:
    #   - clusterissuers.cert-manager.io/istio-ca
    certSigners: []

      - "certificatesigningrequests/approval"
      - "certificatesigningrequests/status"
    verbs: ["update", "create", "get", "delete", "watch"]
  - apiGroups: ["certificates.k8s.io"]
    resources:
      - "signers"
    resourceNames:
    - "kubernetes.io/legacy-unknown"
{{- range .Values.global.certSigners }}
    - {{ . | quote }}
{{- end }}
    verbs: ["approve"]
{{- end}}

  # Used by Istiod to verify the JWT tokens