`PushContext` is built up by querying the above layers. For some simple use cases, this is as simple as storing something like `configstore.List(SomeType)`; in this case, the only difference from directly exposing the configstore is to snapshot the current state. In other cases, some pre-computations and indexes are computed to make later accesses efficient.

#### Endpoints

# show the values after a customization file is applied
istioctl profile dump -f samples/pilot-k8s.yaml

# show differences between the default and demo profiles
istioctl profile dump default > 1.yaml
istioctl profile dump demo > 2.yaml
istioctl profile diff 1.yaml 2.yaml

# show the differences in the generated manifests between the default profile and a customized install
istioctl manifest generate > 1.yaml

## PeerAuthentication and ztunnel

message TopologySpreadConstraint {
  // MaxSkew describes the degree to which pods may be unevenly distributed.
  // When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference
  // between the number of matching pods in the target topology and the global minimum.
  // The global minimum is the minimum number of matching pods in an eligible domain

- [profile](../operator/cmd/mesh/profile.go): dumps the default values for a selected profile, it has the following subcommands:
    - [diff](../operator/cmd/mesh/profile-diff.go): the diff subcommand is used to display the difference between two Istio configuration profiles.
    - [dump](../operator/cmd/mesh/profile-dump.go): the dump subcommand is used to dump the values in an Istio configuration profile.

These are replaced by this chart.
While not required, it is recommended all new users use this chart, and existing users migrate when possible.

This chart has the following benefits and differences:
* Designed with Helm best practices in mind (standardized values options, values schema, values are not all nested under `gateways.istio-ingressgateway.*`, release name and namespace taken into account, etc).