* https://istio.io/latest/news/security/
    * https://istio.io/latest/docs/ops/best-practices/security/

For further documentation see https://istio.io website

{{-
  $deps := dict
    "global.outboundTrafficPolicy" "meshConfig.outboundTrafficPolicy"
    "global.certificates" "meshConfig.certificates"
    "global.localityLbSetting" "meshConfig.localityLbSetting"

  AUTH_HEADER="Authorization: Bearer $(gcloud auth print-access-token)"
  export AUTH_HEADER
fi

ZTUNNEL_REPO_SHA="${ZTUNNEL_REPO_SHA:-$(grep ZTUNNEL_REPO_SHA istio.deps  -A 4 | grep lastStableSHA | cut -f 4 -d '"')}"
ISTIO_ZTUNNEL_VERSION="${ISTIO_ZTUNNEL_VERSION:-${ZTUNNEL_REPO_SHA}}"

# We set up anonymous authentication as this is for demos.
auth:
  strategy: anonymous
deployment:
  pod_labels:
    sidecar.istio.io/inject: "false"
  accessible_namespaces:
  - '**'
  ingress_enabled: false
login_token:
  signing_key: CHANGEME00000000
external_services:
  # Kiali will not start up without tracing service. We don't want to require it.
  tracing:

	ISTIO_ENVOY_ARCH_SUFFIX=""
else
	ISTIO_ENVOY_ARCH_SUFFIX="-${TARGET_ARCH}"
fi

# Populate the git version for istio/proxy (i.e. Envoy)
PROXY_REPO_SHA="${PROXY_REPO_SHA:-$(grep PROXY_REPO_SHA istio.deps  -A 4 | grep lastStableSHA | cut -f 4 -d '"')}"

# Envoy binary variables
ISTIO_ENVOY_BASE_URL="${ISTIO_ENVOY_BASE_URL:-https://storage.googleapis.com/istio-build/proxy}"

sed -i '/PROXY_REPO_SHA/,/lastStableSHA/ { s/"lastStableSHA":.*/"lastStableSHA": "'"$(getSha proxy)"'"/  }; /ZTUNNEL_REPO_SHA/,/lastStableSHA/ { s/"lastStableSHA":.*/"lastStableSHA": "'"$(getSha ztunnel)"'"/  }' istio.deps

# shellcheck disable=SC1001
LATEST_DEB11_DISTROLESS_SHA256=$(crane digest gcr.io/distroless/static-debian11 | awk -F\: '{print $2}')

Istio Automation <******@****.***> 1715107670 -0700

func NewIPSet(name string, v6 bool, deps NetlinkIpsetDeps) (IPSet, error) {
	var err error
	set := IPSet{
		V4Name: fmt.Sprintf(V4Name, name),
		Deps:   deps,
		Prefix: name,
	}
	err = deps.ipsetIPHashCreate(set.V4Name, false)
	if v6 {
		set.V6Name = fmt.Sprintf(V6Name, name)
		v6err := deps.ipsetIPHashCreate(set.V6Name, true)
		err = errors.Join(err, v6err)
	}
	return set, err

    printf '.'
    sleep $SLEEP_TIME
done
printf '\n'

# Update the dependency in istio.deps

  result="$(cd "${dir}" && git rev-parse HEAD)"
  rm -rf "${dir}"

  echo "${result}"
}