{
              "datasource": {
                "type": "prometheus",
                "uid": "${datasource}"
              },
              "expr": "sum(pilot_xds_cds_reject{app=\"istiod\"}) or (absent(pilot_xds_cds_reject{app=\"istiod\"}) - 1)",
              "format": "time_series",
              "hide": false,
              "intervalFactor": 1,
              "legendFormat": "Rejected CDS Configs",

// ValidatingAdmissionPolicySpec is the specification of the desired behavior of the AdmissionPolicy.
message ValidatingAdmissionPolicySpec {
  // ParamKind specifies the kind of resources used to parameterize this policy.
  // If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions.
  // If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied.

# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
meshConfig:
  defaultConfig:
    proxyMetadata:
      ISTIO_META_ENABLE_HBONE: "true"
variant: distroless
pilot:
  variant: distroless
  env:
    # Setup more secure default that is off in 'default' only for backwards compatibility
    VERIFY_CERTIFICATE_AT_CLIENT: "true"
    ENABLE_AUTO_SNI: "true"

    PILOT_ENABLE_HBONE: "true"

# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
meshConfig:
  defaultConfig:
    proxyMetadata:
      ISTIO_META_ENABLE_HBONE: "true"
variant: distroless
pilot:
  variant: distroless
  env:
    # Setup more secure default that is off in 'default' only for backwards compatibility
    VERIFY_CERTIFICATE_AT_CLIENT: "true"
    ENABLE_AUTO_SNI: "true"

    PILOT_ENABLE_HBONE: "true"

meshConfig:
  defaultConfig:
    proxyMetadata:
      ISTIO_META_ENABLE_HBONE: "true"
global:
  platform: openshift
cni:
  ambient:
    enabled: true
  cniBinDir: /var/lib/cni/bin
  cniConfDir: /etc/cni/multus/net.d
  chained: false
  cniConfFileName: "istio-cni.conf"
  excludeNamespaces:
    - kube-system
  logLevel: info
  privileged: true
  provider: "multus"
pilot:
  cni:
    enabled: true
    provider: "multus"

global:
  platform: openshift
cni:
  ambient:
    enabled: true
  cniBinDir: /var/lib/cni/bin
  cniConfDir: /etc/cni/multus/net.d
  chained: false
  cniConfFileName: "istio-cni.conf"
  logLevel: info
  privileged: true
  provider: "multus"
pilot:
  cni:
    enabled: true
    provider: "multus"
  variant: distroless
  env:
    PILOT_ENABLE_AMBIENT: "true"

		createNamespace("ambient", map[string]string{
			constants.DataplaneMode: constants.DataplaneModeAmbient,
		}),
		createNamespace("no-ambient", map[string]string{
			constants.DataplaneMode: constants.DataplaneModeAmbient,
			"istio-injection":       "enabled",
		}),
	}

	client := kube.NewFakeClient(nss...)
	expected := sets.New[string]("default", "no-ambient")

					EnableIPv6:      cfg.InstallConfig.AmbientIPv6,
				})
			if err != nil {
				return fmt.Errorf("failed to create ambient nodeagent service: %v", err)
			}

			ambientAgent.Start()
			defer ambientAgent.Stop()

			log.Info("Ambient node agent started, starting installer...")

		} else {
			// Ambient not enabled, so this readiness flag is no-op'd
			watchServerReady.Store(true)
		}

              value: "{{ .Values.cni.chained }}"
            - name: REPAIR_ENABLED
              value: "{{ .Values.cni.repair.enabled }}"
{{- if .Values.cni.ambient.enabled }}
            - name: AMBIENT_DNS_CAPTURE
              value: "{{ .Values.cni.ambient.dnsCapture }}"
{{- end }}
            - name: REPAIR_NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName

  logLevel: info

  # Set to `type: RuntimeDefault` to use the default profile if available.
  seLinuxOptions: {}
  # TODO Ambient inpod - for OpenShift, set to the following to get writable sockets in hostmounts to work, eventually consider CSI driver instead
  #seLinuxOptions: