{"-t", iptablesconstants.MANGLE, "-D", iptablesconstants.OUTPUT, "-j", ChainInpodOutput},
		{"-t", iptablesconstants.NAT, "-D", iptablesconstants.OUTPUT, "-j", ChainInpodOutput},
	}

	// these sometimes fail due to "Device or resource busy"
	optionalDeleteCmds := [][]string{
		// flush-then-delete our created chains
		{"-t", iptablesconstants.MANGLE, "-F", ChainInpodPrerouting},
		{"-t", iptablesconstants.MANGLE, "-F", ChainInpodOutput},

  // +optional
  optional string clusterIP = 3;

  // ClusterIPs is a list of IP addresses assigned to this service, and are
  // usually assigned randomly.  If an address is specified manually, is
  // in-range (as per system configuration), and is not in use, it will be
  // allocated to the service; otherwise creation of the service will fail.

{{- if .Values.global.remotePilotAddress }}
apiVersion: v1
kind: Service
metadata:
  {{- if .Values.pilot.enabled }}
  # when local istiod is enabled, we can't use istiod service name to reach the remote control plane
  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}-remote
  {{- else }}
  # when local istiod isn't enabled, we can use istiod service name to reach the remote control plane

// +structType=atomic
message EndpointPort {
  // name represents the name of this port. All ports in an EndpointSlice must have a unique name.
  // If the EndpointSlice is dervied from a Kubernetes service, this corresponds to the Service.ports[].name.
  // Name must either be an empty string or pass DNS_LABEL validation:
  // * must be no more than 63 characters long.
  // * must consist of lower case alphanumeric characters or '-'.

          "service": "bookinfo/reviews.bookinfo.svc.cluster.local",
          "address": "/10.244.1.38",
          "port": {
            "9080": 9080
          }
        },
        "Kubernetes//Pod/bookinfo/reviews-v1-5b5d6494f4-qwjv4:/10.244.1.37": {
          "workloadUid": "Kubernetes//Pod/bookinfo/reviews-v1-5b5d6494f4-qwjv4",
          "service": "bookinfo/reviews.bookinfo.svc.cluster.local",

  extensionProviders:
    - name: otel
      envoyOtelAls:
        service: opentelemetry-collector.observability.svc.cluster.local
        port: 4317
    - name: skywalking
      skywalking:
        service: tracing.istio-system.svc.cluster.local
        port: 11800
    - name: otel-tracing
      opentelemetry:
        port: 4317
        service: opentelemetry-collector.observability.svc.cluster.local

global:
  proxy:

# Set enableTracing to false to disable request tracing.
enableTracing: true
# This is the ingress service name, update if you used a different name
ingressService: istio-ingress
#
defaultConfig:
  # NOTE: If you change any values in this section, make sure to make
  # the same changes in start up args in istio-ingress pods.
  #
  # TCP connection timeout between Envoy & the application, and between Envoys.
  connectTimeout: 1s
  #

metadata:
  labels:
    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}

        service:
          name: webhook-service
          namespace: metallb-system
          path: /convert
      conversionReviewVersions:
      - v1beta1
      - v1beta2
  group: metallb.io
  names:
    kind: BGPPeer

metadata:
  labels:
    app: sidecar-injector
    istio.io/tag: default
  name: w-istio-sidecar-injector-istio-system
  
webhooks:
- admissionReviewVersions:
  - v1beta1
  - v1
  clientConfig:
    service:
      name: istiod
      namespace: istio-system
      path: /inject
      port: 443
  failurePolicy: Fail
  matchPolicy: Equivalent
  name: rev.namespace.sidecar-injector.istio.io
  namespaceSelector: