name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
    namespace: {{ .Values.global.istioNamespace }}
---
{{- if not (eq (toString .Values.pilot.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}

  ASSERT_EQ(errors::OK, s.code()) << s.message();
  if (isa<TracingOperation>(check_numerics_op.get())) {
    s = dyn_cast<TracingOperation>(check_numerics_op.get())
            ->SetOpName("check_numerics");
    ASSERT_EQ(errors::OK, s.code()) << s.message();
  }
  s = AddInput(check_numerics_op.get(), t.get(), &forward_op);
  ASSERT_EQ(errors::OK, s.code()) << s.message();

    rootNamespace: {{ .Values.meshConfig.rootNamespace | default .Values.global.istioNamespace }}

  {{ $prom := include "default-prometheus" . | eq "true" }}
  {{ $sdMetrics := include "default-sd-metrics" . | eq "true" }}
  {{ $sdLogs := include "default-sd-logs" . | eq "true" }}
  {{- if or $prom $sdMetrics $sdLogs }}
    defaultProviders:
    {{- if or $prom $sdMetrics }}
      metrics:

  ASSERT_EQ(TF_OK, TF_GetCode(status)) << TF_Message(status);
  const DLTensor* dltensor_out = &dlm_out->dl_tensor;
  EXPECT_EQ(dltensor_out->device.device_type, dltensor_in->device.device_type);
  EXPECT_EQ(dltensor_out->device.device_id, dltensor_in->device.device_id);
  EXPECT_EQ(dltensor_out->ndim, dltensor_in->ndim);
  EXPECT_EQ(dltensor_out->dtype.code, dltensor_in->dtype.code);

  {{- if and (eq .Values.consoleService.type "ClusterIP") .Values.consoleService.clusterIP }}
  clusterIP: {{ .Values.consoleService.clusterIP }}
  {{- end }}
  {{- if or (eq .Values.consoleService.type "LoadBalancer") (eq .Values.consoleService.type "NodePort") }}
  externalTrafficPolicy: {{ .Values.consoleService.externalTrafficPolicy | quote }}
  {{- end }}

  auto s = GetValue(t, &analytical_tensor);
  ASSERT_EQ(errors::OK, s.code()) << s.message();

  int64_t num_elem_analytical = 1;
  auto num_dims_analytical = TF_NumDims(analytical_tensor);
  ASSERT_EQ(dims.size(), num_dims_analytical);
  for (int j = 0; j < num_dims_analytical; j++) {
    auto dim_analytical = TF_Dim(analytical_tensor, j);
    ASSERT_EQ(dims[j], dim_analytical);
    num_elem_analytical *= dim_analytical;
  }

    CHECK_EQ(errors::OK, s.code()) << s.message();
  }
};

class PassThroughGradientFunction : public GradientFunction {
 public:
  Status Compute(AbstractContext* ctx,
                 absl::Span<AbstractTensorHandle* const> grad_outputs,
                 absl::Span<AbstractTensorHandle*> grad_inputs) override {
    CHECK_EQ(grad_outputs.size(), 1);
    CHECK_EQ(grad_inputs.size(), 1);

    name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
    namespace: {{ .Values.global.istioNamespace }}
---
{{- if not (eq (toString .Values.pilot.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}

      mountPath: /var/run/secrets/credential-uds
    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
    - name: gke-workload-certificate
      mountPath: /var/run/secrets/workload-spiffe-credentials
      readOnly: true
    {{- else }}
    - name: workload-certs
      mountPath: /var/run/secrets/workload-spiffe-credentials
    {{- end }}
    {{- if eq .Values.global.pilotCertProvider "istiod" }}

apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
{{- if eq .Release.Namespace "istio-system"}}
  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
{{- else }}
  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
{{- end }}
  labels: