defaultTemplates: []
  istiodRemote:
    # Sidecar injector mutating webhook configuration clientConfig.url value.
    # For example: https://$remotePilotAddress:15017/inject
    # The host should not refer to a service running in the cluster; use a service reference by specifying
    # the clientConfig.service field instead.
    injectionURL: ""

  // not share the same nomenclature for nodes. For example, Kubernetes may
  // refer to a given node as "node1", but the storage system may refer to
  // the same node as "nodeA". When Kubernetes issues a command to the storage
  // system to attach a volume to a specific node, it can use this field to
  // refer to the node name using the ID that the storage system will

{{- define "mesh" }}
    # The trust domain corresponds to the trust root of a system.
    # Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
    trustDomain: "cluster.local"

    # The namespace to treat as the administrative root namespace for Istio configuration.
    # When processing a leaf namespace Istio will search for declarations in that namespace first

  // capabilities. This must contain at least one address but no more than
  // 100. These are all assumed to be fungible and clients may choose to only
  // use the first element. Refer to: https://issue.k8s.io/106267
  // +listType=set
  repeated string addresses = 1;

  // conditions contains information about the current status of the endpoint.
  optional EndpointConditions conditions = 2;

## HBONE

Along with pass-through traffic, Ztunnel supports the "HBONE" (HTTP-Based Overlay Network) protocol.
This is not really so much a new protocol, but rather a name we came up with to refer to the expectations of clients and servers communicating in the mesh.

HBONE is just a standard HTTP `CONNECT` tunnel, over mutual TLS with mesh (SPIFFE) certificates, on a well known port (15008).

  // Implementations of this API should ignore Ingresses without a class
  // specified. An IngressClass resource may be marked as default, which can
  // be used to set a default value for this field. For more information,
  // refer to the IngressClass documentation.
  // +optional
  optional string ingressClassName = 4;

  // backend is the default backend capable of servicing requests that don't match any

  // formally defined, it was widely supported by Ingress controllers to create
  // a direct binding between Ingress controller and Ingress resources. Newly
  // created Ingress resources should prefer using the field. However, even
  // though the annotation is officially deprecated, for backwards compatibility
  // reasons, ingress controllers should still honor that annotation if present.
  // +optional

message WebhookClientConfig {
  // `url` gives the location of the webhook, in standard URL form
  // (`scheme://host:port/path`). Exactly one of `url` or `service`
  // must be specified.
  //
  // The `host` should not refer to a service running in the cluster; use
  // the `service` field instead. The host might be resolved via external
  // DNS in some apiservers (e.g., `kube-apiserver` cannot resolve

message WebhookClientConfig {
  // `url` gives the location of the webhook, in standard URL form
  // (`scheme://host:port/path`). Exactly one of `url` or `service`
  // must be specified.
  //
  // The `host` should not refer to a service running in the cluster; use
  // the `service` field instead. The host might be resolved via external
  // DNS in some apiservers (e.g., `kube-apiserver` cannot resolve

  // not share the same nomenclature for nodes. For example, Kubernetes may
  // refer to a given node as "node1", but the storage system may refer to
  // the same node as "nodeA". When Kubernetes issues a command to the storage
  // system to attach a volume to a specific node, it can use this field to
  // refer to the node name using the ID that the storage system will