imagePullPolicy: ""

  imagePullSecrets: []

  # This value is used to configure a Kubernetes PodDisruptionBudget for the gateway.
  #
  # By default, the `podDisruptionBudget` is disabled (set to `{}`),
  # which means that no PodDisruptionBudget resource will be created.
  #
  # To enable the PodDisruptionBudget, configure it by specifying the
  # `minAvailable` or `maxUnavailable`. For example, to set the

[[ ${UID} -ne 0 ]] && DOCKER_RUN_OPTIONS+=(-u "${UID}:${DOCKER_GID}")

# $CONTAINER_OPTIONS becomes an empty arg when quoted, so SC2086 is disabled for the
# following command only
# shellcheck disable=SC2086
"${CONTAINER_CLI}" run \
    --rm \
    "${DOCKER_RUN_OPTIONS[@]}" \
    --init \
    --sig-proxy=true \
    ${DOCKER_SOCKET_MOUNT:--v /var/run/docker.sock:/var/run/docker.sock} \
    $CONTAINER_OPTIONS \

    injectedAnnotations: {}

    # This enables injection of sidecar in all namespaces,
    # with the exception of namespaces with "istio-injection:disabled" annotation
    # Only one environment should have this enabled.
    enableNamespacesByDefault: false

          (strdict "istio.io/rev" (.Revision | default "default"))
          (strdict
            "ambient.istio.io/redirection" "disabled"
            "prometheus.io/path" "/stats/prometheus"
            "prometheus.io/port" "15020"
            "prometheus.io/scrape" "true"
          ) | nindent 8 }}
      labels:
        {{- toJsonMap

    - "sidecar.istio.io/status" annotation is not present on the pod (created by injection of sidecar)
    - "ambient.istio.io/redirection" is not "disabled"
- sidecar interception is enabled if:
    - "istio-init" container is not present in the pod.
    - istio-proxy container exists and
        - does not have DISABLE_ENVOY environment variable (which triggers proxyless mode)

	matchAmbient := labels[constants.DataplaneMode] == constants.DataplaneModeAmbient
	if matchAmbient {
		log.Infof("Namespace %s is enabled in ambient mesh", namespace)
	} else {
		log.Infof("Namespace %s is disabled from ambient mesh", namespace)
	}
	for _, pod := range s.pods.List(namespace, klabels.Everything()) {
		// ztunnel pods are never "added to/removed from the mesh", so do not fire

# The empty profile has everything disabled
# This is useful as a base for custom user configuration
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  components:
    base:
      enabled: false
    pilot:
      enabled: false
    ingressGateways:
    - name: istio-ingressgateway

                                      Indicates whether connections to this port should be secured using TLS.

                                      Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL
                                    enum:
                                    - DISABLE
                                    - SIMPLE
                                    - MUTUAL
                                    - ISTIO_MUTUAL

  // +optional
  optional int32 matchingPrecedence = 2;

  // `distinguisherMethod` defines how to compute the flow distinguisher for requests that match this schema.
  // `nil` specifies that the distinguisher is disabled and thus will always be the empty string.
  // +optional
  optional FlowDistinguisherMethod distinguisherMethod = 3;

  // +optional
  optional int32 matchingPrecedence = 2;

  // `distinguisherMethod` defines how to compute the flow distinguisher for requests that match this schema.
  // `nil` specifies that the distinguisher is disabled and thus will always be the empty string.
  // +optional
  optional FlowDistinguisherMethod distinguisherMethod = 3;