{{- end }}
{{- end }}

{{/* We take the mesh config above, defined with individual values.yaml, and merge with .Values.meshConfig */}}
{{/* The intent here is that meshConfig.foo becomes the API, rather than re-inventing the API in values.yaml */}}
{{- $originalMesh := include "mesh" . | fromYaml }}
{{- $mesh := mergeOverwrite $originalMesh .Values.meshConfig }}

{{- if .Values.pilot.configMap }}
apiVersion: v1
kind: ConfigMap

resources we configure have 1000s of fields; given enough users and bespoke use cases, eventually someone will want to customize every one of those fields. If all fields are exposed in `values.yaml`, we end up with an massive API that is also likely worse than just using the Kubernetes API directly. To avoid this, the project attempts to minimize additions to the `values.yaml` API where possible. If the change is a dynamic runtime configuration, it probably belongs in the [MeshConfig API](https://github...

    # see
    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
    # This does not apply to gateway pods as they typically need a different
    # set of DNS settings than the normal application pods (e.g., in
    # multicluster scenarios).
    # NOTE: If using templates, follow the pattern in the commented example below.
    #podDNSSearchNamespaces:
    #- global

{{- else if .Values.cni.repair.deletePods }}
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["delete"]
{{- else if .Values.cni.repair.labelPods }}
  - apiGroups: [""]
    {{- /* pods/status is less privileged than the full pod, and either can label. So use the lower pods/status */}}
    resources: ["pods/status"]
    verbs: ["patch", "update"]
{{- end }}
{{- end }}
---
{{- if .Values.cni.ambient.enabled }}

#########################
## Config for sass-lint
#########################
# Linter Options
options:
  # Don't merge default rules
  merge-default-rules: false
  # Raise an error if more than 50 warnings are generated
  max-warnings: 500
# Rule Configuration
rules:
  attribute-quotes:
    - 2
    -
      include: false
  bem-depth: 2
  border-zero: 2
  brace-style: 2
  class-name-format: 2
  clean-import-paths: 2

      tolerations: []

      # Specify the pod anti-affinity that allows you to constrain which nodes
      # your pod is eligible to be scheduled based on labels on pods that are
      # already running on the node rather than based on labels on nodes.
      # There are currently two types of anti-affinity:
      #    "requiredDuringSchedulingIgnoredDuringExecution"
      #    "preferredDuringSchedulingIgnoredDuringExecution"

      tolerations: []

      # Specify the pod anti-affinity that allows you to constrain which nodes
      # your pod is eligible to be scheduled based on labels on pods that are
      # already running on the node rather than based on labels on nodes.
      # There are currently two types of anti-affinity:
      #    "requiredDuringSchedulingIgnoredDuringExecution"
      #    "preferredDuringSchedulingIgnoredDuringExecution"

      {{- end }}
{{- end }}

{{/* We take the mesh config above, defined with individual values.yaml, and merge with .Values.meshConfig */}}
{{/* The intent here is that meshConfig.foo becomes the API, rather than re-inventing the API in values.yaml */}}
{{- $originalMesh := include "mesh" . | fromYaml }}
{{- $mesh := mergeOverwrite $originalMesh .Values.meshConfig }}

{{- if .Values.pilot.configMap }}
apiVersion: v1
kind: ConfigMap

    # see
    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
    # This does not apply to gateway pods as they typically need a different
    # set of DNS settings than the normal application pods (e.g., in
    # multicluster scenarios).
    # NOTE: If using templates, follow the pattern in the commented example below.
    #podDNSSearchNamespaces:
    #- global