}

// PodSchedulingContext objects hold information that is needed to schedule
// a Pod with ResourceClaims that use "WaitForFirstConsumer" allocation
// mode.
//
// This is an alpha type and requires enabling the DynamicResourceAllocation
// feature gate.
message PodSchedulingContext {
  // Standard object metadata
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

# Avoid creating a bunch of RBAC rules for features we are not enabling
rbac:
  create: false
  pspEnabled: false

# Disable test pods
testFramework:
  enabled: false

podLabels:
  sidecar.istio.io/inject: "false"

# Demo only, so we will have no authentication
admin:
  existingSecret: ""
ldap:
  existingSecret: true
env:
  GF_SECURITY_ADMIN_USER: "admin"
  GF_SECURITY_ADMIN_PASSWORD: "admin"

  // lowered if there are no expansion operations in progress and if the actual volume capacity
  // is equal or lower than the requested capacity.
  // This is an alpha field and requires enabling RecoverVolumeExpansionFailure feature.
  // +featureGate=RecoverVolumeExpansionFailure
  // +optional
  map<string, k8s.io.apimachinery.pkg.api.resource.Quantity> allocatedResources = 5;

server the project provides. # This is disabled by default, as the cluster may already have a validation server; while technically # it works to have multiple redundant validations, this adds complexity and operational risks. # Users should consider enabling this if they want full gateway-api validation but don't have other validation servers. validateGateway: false istiodRemote: # Sidecar injector mutating webhook configuration url # For example: https://$remotePilotAddress:15017/inject injectionURL:...

  // so resource intensive daemonsets should take into account that they may
  // cause evictions during disruption.
  // This is an alpha field and requires enabling DaemonSetUpdateSurge feature gate.
  // +optional
  optional k8s.io.apimachinery.pkg.util.intstr.IntOrString maxSurge = 2;
}

// Spec to control the desired behavior of rolling update.

    # rules should be exported to. Currently only one value can be provided in this list. This value
    # should be one of the following two options:
    # * implies these objects are visible to all namespaces, enabling any sidecar to talk to any other sidecar.
    # . implies these objects are visible to only to sidecars in the same namespace, or if imported as a Sidecar.egress.host
    defaultConfigVisibilitySettings: []

    # rules should be exported to. Currently only one value can be provided in this list. This value
    # should be one of the following two options:
    # * implies these objects are visible to all namespaces, enabling any sidecar to talk to any other sidecar.
    # . implies these objects are visible to only to sidecars in the same namespace, or if imported as a Sidecar.egress.host
    defaultConfigVisibilitySettings: []

func TestManifestGenerateZtunnel(t *testing.T) {
	runTestGroup(t, testGroup{
		{
			desc:       "ztunnel",
			diffSelect: "DaemonSet:*:ztunnel",
		},
	})
}

// TestManifestGenerateHelmValues tests whether enabling components through the values passthrough interface works as
// expected i.e. without requiring enablement also in IstioOperator API.
func TestManifestGenerateHelmValues(t *testing.T) {
	runTestGroup(t, testGroup{
		{