Revision string
	// Components is a list of strings specifying which component's manifests to be generated.
	Components []string
	// Filter is the list of components to render
	Filter []string
}

var kubeClientFunc func() (kube.CLIClient, error)

func (a *ManifestGenerateArgs) String() string {
	var b strings.Builder
	b.WriteString("InFilenames:   " + fmt.Sprint(a.InFilenames) + "\n")

	istioInjectionWebhookSuffix = "sidecar-injector.istio.io"

	vwhBaseTemplateName = "istiod-default-validator"

	operatorNamespace = "operator.istio.io"
)

// tagWebhookConfig holds config needed to render a tag webhook.
type tagWebhookConfig struct {
	Tag            string
	Revision       string
	URL            string
	Path           string
	CABundle       string
	IstioNamespace string

        control plane version: 1.0.0
        data plane version: 1.0.0 (100 proxies)
        $ kubectl version
        Client Version: v1.0.0
        Kustomize Version: v1.0.0
        Server Version: v1.0.0
      render: Text
    validations:
      required: true
  - type: textarea
    id: additional-info
    attributes:
      label: Additional Information
      description: |

    injectedAnnotations:
      {{- range $key, $val := .Values.sidecarInjectorWebhook.injectedAnnotations }}
      "{{ $key }}": {{ $val | quote }}
      {{- end }}
    {{- /* If someone ends up with this new template, but an older Istiod image, they will attempt to render this template
         which will fail with "Pod injection failed: template: inject:1: function "Istio_1_9_Required_Template_And_Version_Mismatched" not defined".

parent feature is disabled.

## K8s controller

TODO(rcernich).

## Manifest creation

Manifest rendering is a multi-step process, shown in the figure below. ![rendering
process](images/operator_render_flow.svg) The example in the figure shows the rendering being triggered by a CLI `mesh`
command with a `IstioOperatorSpec` CR passed to it from a file; however, the same rendering steps would occur when an

		return "", fmt.Errorf("failed running base discovery Helm renderer: %w", err)
	}

	values := fmt.Sprintf(`
global:
  istioNamespace: %s
`, opt.Namespace)

	// Render the templates required for the service account and role bindings.
	baseContent, err := baseRenderer.RenderManifestFiltered(values, func(template string) bool {
		for _, t := range baseTemplates {

		diag.Info:    "",           // no special color for info messages
		diag.Warning: "\033[33m",   // yellow
		diag.Error:   "\033[1;31m", // bold red
	}
)

// render turns a Message instance into a string with an option of colored bash output
func render(m diag.Message, colorize bool) string {
	return fmt.Sprintf("%s%v%s [%v]%s %s",
		colorPrefix(m, colorize), m.Type.Level(), colorSuffix(colorize),

	orn := operatorResourceName
	if revision != "" {
		orn += "-" + revision
	}
	return deploymentExists(cs, operatorNamespace, orn)
}

// renderOperatorManifest renders a manifest to install the operator with the given input arguments.
func renderOperatorManifest(_ *RootArgs, ocArgs *operatorCommonArgs) (string, string, error) {

This is fairly straightforward.

First, we need to check that this traffic is allowed.
Traffic may be denied by RBAC policies (especially from a `STRICT` mode enforcement, which denies plaintext traffic).

If it is allowed, we will forward to the target destination.

#### Hairpin

						}
					}
				}()
			}
			var valuesConfig string
			var sidecarTemplate inject.RawTemplates
			var meshConfig *meshconfig.MeshConfig
			rev := opts.Revision
			// if the revision is "default", render templates with an empty revision
			if rev == util.DefaultRevisionName {
				rev = ""
			}
			injectorAddress := centralOpts.Xds
			index := strings.IndexByte(injectorAddress, ':')
			if index != -1 {