[[ ${UID} -ne 0 ]] && DOCKER_RUN_OPTIONS+=(-u "${UID}:${DOCKER_GID}")

# $CONTAINER_OPTIONS becomes an empty arg when quoted, so SC2086 is disabled for the
# following command only
# shellcheck disable=SC2086
"${CONTAINER_CLI}" run \
    --rm \
    "${DOCKER_RUN_OPTIONS[@]}" \
    --init \
    --sig-proxy=true \
    ${DOCKER_SOCKET_MOUNT:--v /var/run/docker.sock:/var/run/docker.sock} \
    $CONTAINER_OPTIONS \

  imagePullPolicy: ""

  imagePullSecrets: []

  # This value is used to configure a Kubernetes PodDisruptionBudget for the gateway.
  #
  # By default, the `podDisruptionBudget` is disabled (set to `{}`),
  # which means that no PodDisruptionBudget resource will be created.
  #
  # To enable the PodDisruptionBudget, configure it by specifying the
  # `minAvailable` or `maxUnavailable`. For example, to set the

	matchAmbient := labels[constants.DataplaneModeLabel] == constants.DataplaneModeAmbient
	if matchAmbient {
		log.Infof("Namespace %s is enabled in ambient mesh", namespace)
	} else {
		log.Infof("Namespace %s is disabled from ambient mesh", namespace)
	}
	for _, pod := range s.pods.List(namespace, klabels.Everything()) {
		// ztunnel pods are never "added to/removed from the mesh", so do not fire

# The empty profile has everything disabled
# This is useful as a base for custom user configuration
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  components:
    base:
      enabled: false
    pilot:
      enabled: false
    ingressGateways:
    - name: istio-ingressgateway

Any changes to this folder should have a `make copy-templates` applied afterwards.

Warning: unlike the `IstioOperator` profiles, these profiles cannot enable or disable certain components.
As a result, users still need to ensure they install the appropriate charts to use a profile correctly.

    else
      # if we aren't a TTY, run directly as script will always run with a tty, which may output content that
      # we cannot display
      set -o pipefail; "$@" 2>&1 | tee "${tmpFile}"
    fi
    # shellcheck disable=SC2181
    if [[ $? == 0 ]]; then
      break
    fi
    if ! grep -Eq "${failureRegex}" "${tmpFile}"; then
      fail "Unexpected failure"
    fi
    if [[ $n -lt $max ]]; then
      ((n++))

# "make update-common".

rules:
  braces: disable
  brackets: disable
  colons: enable
  commas: disable
  comments: disable
  comments-indentation: disable
  document-end: disable
  document-start: disable
  empty-lines: disable
  empty-values: disable
  hyphens: enable
  indentation: disable
  key-duplicates: enable
  key-ordering: disable
  line-length: disable
  new-line-at-end-of-file: disable

KUBE_DNS_PORT_53_TCP_PORT=53
# shellcheck disable=SC2034
KUBE_DNS_PORT_53_TCP=tcp://10.110.0.10:53
# shellcheck disable=SC2034
KUBERNETES_SERVICE_PORT=443
# shellcheck disable=SC2034
KUBE_DNS_SERVICE_PORT_DNS=53
# shellcheck disable=SC2034
KUBE_DNS_SERVICE_PORT_DNS_TCP=53
# shellcheck disable=SC2034
KUBERNETES_SERVICE_HOST=10.110.0.1
# shellcheck disable=SC2034
KUBE_DNS_PORT_53_UDP_PORT=53
# shellcheck disable=SC2034

apiVersion: v1
kind: Namespace
metadata:
  name: user-ingressgateway-ns
  labels:

  # Default: []
  exclude-files:
    - ".*\\.pb\\.go"
    - ".*\\.gen\\.go"
  # Maximum issues count per one linter.
  # Set to 0 to disable.
  # Default: 50
  max-issues-per-linter: 0
  # Maximum count of issues with the same text. Set to 0 to disable. Default is 3.