// "csi.storage.k8s.io/pod.name": pod.Name
  // "csi.storage.k8s.io/pod.namespace": pod.Namespace
  // "csi.storage.k8s.io/pod.uid": string(pod.UID)
  // "csi.storage.k8s.io/ephemeral": "true" if the volume is an ephemeral inline volume
  //                                 defined by a CSIVolumeSource, otherwise "false"
  //
  // "csi.storage.k8s.io/ephemeral" is a new feature in Kubernetes 1.16. It is only

}

# ztunnel binary vars (TODO handle debug builds, arm, darwin etc.)
ISTIO_ZTUNNEL_BASE_URL="${ISTIO_ZTUNNEL_BASE_URL:-https://storage.googleapis.com/istio-build/ztunnel}"

# If we are not using the default, assume its private and we need to authenticate
if [[ "${ISTIO_ZTUNNEL_BASE_URL}" != "https://storage.googleapis.com/istio-build/ztunnel" ]]; then
  AUTH_HEADER="Authorization: Bearer $(gcloud auth print-access-token)"
  export AUTH_HEADER

      operator: DoesNotExist
    - key: istio.io/rev
      operator: DoesNotExist
    - key: "kubernetes.io/metadata.name"
      operator: "NotIn"
      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
  objectSelector:
    matchExpressions:
    - key: sidecar.istio.io/inject
      operator: DoesNotExist
    - key: istio.io/rev
      operator: DoesNotExist
{{- end }}

{{- end }}
---

            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        required:
        - spec
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    "helm.sh/resource-policy": keep
  labels:

      type: date
    name: v1alpha1
    subresources:
      status: {}
    schema:
      openAPIV3Schema:
        type: object
        x-kubernetes-preserve-unknown-fields: true
    served: true
    storage: true

# Istio Ztunnel Helm Chart

This chart installs an Istio ztunnel.

## Setup Repo Info

```console
helm repo add istio https://istio-release.storage.googleapis.com/charts
helm repo update
```

_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._

## Installing the Chart

To install the chart:

```console
helm install ztunnel istio/ztunnel
```

## Uninstalling the Chart

kube-system        coredns-5dd5756b68-nzlpw                             10.244.0.3  ambient-control-plane None                                TCP
local-path-storage local-path-provisioner-6f8956fb48-vvnpn              10.244.0.4  ambient-control-plane None                                TCP

# Envoy binary variables
ISTIO_ENVOY_BASE_URL="${ISTIO_ENVOY_BASE_URL:-https://storage.googleapis.com/istio-build/proxy}"

# If we are not using the default, assume its private and we need to authenticate
if [[ "${ISTIO_ENVOY_BASE_URL}" != "https://storage.googleapis.com/istio-build/proxy" ]]; then
  AUTH_HEADER="Authorization: Bearer $(gcloud auth print-access-token)"
  export AUTH_HEADER
fi

      operator: DoesNotExist
    - key: istio.io/rev
      operator: DoesNotExist
    - key: "kubernetes.io/metadata.name"
      operator: "NotIn"
      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
  objectSelector:
    matchExpressions:
    - key: sidecar.istio.io/inject
      operator: DoesNotExist
    - key: istio.io/rev
      operator: DoesNotExist
{{- end }}

{{- end }}

// StatefulSet represents a set of pods with consistent identities.
// Identities are defined as:
//   - Network: A single stable DNS and hostname.
//   - Storage: As many VolumeClaims as requested.
//
// The StatefulSet guarantees that a given network identity will always
// map to the same storage identity.
message StatefulSet {
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;