For large-scale gateways it is optionally possible to use a dedicated pilot in the gateway namespace.

### Additional test templates

A number of helm test setups are general-purpose and should be installable in any cluster, to confirm

  // For example, a handler called "runc" might specify that the runc OCI
  // runtime (using native Linux containers) will be used to run the containers
  // in a pod.
  // The handler must be lowercase, conform to the DNS Label (RFC 1123) requirements,
  // and is immutable.
  optional string handler = 2;

  // overhead represents the resource overhead associated with running a pod for a

  // endpoint.
  // +optional
  optional k8s.io.api.core.v1.ObjectReference targetRef = 4;

  // topology contains arbitrary topology information associated with the
  // endpoint. These key/value pairs must conform with the label format.
  // https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
  // Topology may include a maximum of 16 key/value pairs. This includes, but
  // is not limited to the following well known keys:

  // For example, a handler called "runc" might specify that the runc OCI
  // runtime (using native Linux containers) will be used to run the containers
  // in a pod.
  // The Handler must be lowercase, conform to the DNS Label (RFC 1123) requirements,
  // and is immutable.
  optional string handler = 2;

  // overhead represents the resource overhead associated with running a pod for a

    server: https://10.96.0.1:443
  name: local
contexts:
- context:
    cluster: local
    user: istio-cni
  name: istio-cni-context
current-context: istio-cni-context
kind: Config
preferences: {}
users:
- name: istio-cni
  user:

  // For example, a handler called "runc" might specify that the runc OCI
  // runtime (using native Linux containers) will be used to run the containers
  // in a pod.
  // The runtimeHandler must be lowercase, conform to the DNS Label (RFC 1123)
  // requirements, and is immutable.
  optional string runtimeHandler = 1;

  // overhead represents the resource overhead associated with running a pod for a

## PeerAuthentication and ztunnel

	@go list -f '{{ join .Deps "\n" }}' -tags=agent \
			./pilot/cmd/pilot-agent/app \
			./pkg/istio-agent/... | sort | uniq |\
		grep -Pv '^k8s.io/(utils|klog|apimachinery)/' |\
		grep -Pv 'envoy/type/|envoy/annotations|envoy/config/core/' |\
		grep -Pv 'envoy/extensions/transport_sockets/tls/' |\
		grep -Pv 'envoy/service/discovery/v3' |\
		grep -Pv 'envoy/extensions/wasm/' |\
		grep -Pv 'envoy/extensions/filters/(http|network)/wasm/' |\

  // +optional
  optional NodeConfigSource active = 2;

  // LastKnownGood reports the checkpointed config the node will fall back to
  // when it encounters an error attempting to use the Assigned config.
  // The Assigned config becomes the LastKnownGood config when the node determines
  // that the Assigned config is stable and correct.

That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.

### Examples

#### Configuring mesh configuration settings

Any [Mesh Config](https://istio.io/latest/docs/reference/config/istio.mesh.v1alpha1/) options can be configured like below:

```yaml
meshConfig:
  accessLogFile: /dev/stdout
```

#### Revisions