{{- if .Values.global.configCluster }}
{{- if not (eq .Values.defaultRevision "") }}
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: istiod-default-validator
  labels:
    app: istiod
    release: {{ .Release.Name }}
    istio: istiod
    istio.io/rev: {{ .Values.defaultRevision }}
webhooks:
  - name: validation.istio.io
    clientConfig:
      {{- if .Values.base.validationURL }}

{{- if not (eq .Values.defaultRevision "") }}
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: istiod-default-validator
  labels:
    app: istiod
    release: {{ .Release.Name }}
    istio: istiod
    istio.io/rev: {{ .Values.defaultRevision | quote }}
webhooks:
  - name: validation.istio.io
    clientConfig:
      {{- if .Values.base.validationURL }}
      url: {{ .Values.base.validationURL }}

{{- if and .Values.experimental.stableValidationPolicy (not (eq .Values.defaultRevision "")) }}
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: "stable-channel-default-policy.istio.io"
  labels:
    release: {{ .Release.Name }}
    istio: istiod
    istio.io/rev: {{ .Values.defaultRevision }}
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups:

    # Validation webhook caBundle value. Useful when running pilot with a well known cert
    validationCABundle: ""

    # For istioctl usage to disable istio config crds in base
    enableIstioConfigCRDs: true

  defaultRevision: "default"
  experimental:

      enabled: true
    egressGateways:
    - name: istio-egressgateway
      enabled: false

  # Most default values come from the helm chart's values.yaml
  # Below are the things that differ
  values:
    defaultRevision: ""
    global:
      istioNamespace: istio-system
      configValidation: true
    gateways:
      istio-ingressgateway: {}

helm status {{ .Release.Name }} $ helm get all {{ .Release.Name }} manifests/charts/base/templates/default.yaml {{- if not (eq .Values.defaultRevision "") }} apiVersion: admissionregistratio.k8s.io/v1 kind: ValidatingWebhookCon metadata: name: istiod-default-validator labels: app: istiod release: {{ .Release.Name }} istio: istiod istio.io/rev: {{ .Values.defaultRevision }} webhooks: - name: validation.istio.io clientConfig: {{- if .Values.base.validationURL }} url: {{ .Values.base.validationURL }} {{-...