# it's a comma-separated list of prefixes
    local-prefixes: istio.io/
issues:
  # Which dirs to exclude: issues from them won't be reported.
  # Can use regexp here: `generated.*`, regexp is applied on full path,
  # including the path prefix if one is set.
  # Default dirs are skipped independently of this option's value (see exclude-dirs-use-default).

# This is disabled by default, as the cluster may already have a validation server; while technically # it works to have multiple redundant validations, this adds complexity and operational risks. # Users should consider enabling this if they want full gateway-api validation but don't have other validation servers. validateGateway: false istiodRemote: # Sidecar injector mutating webhook configuration url # For example: https://$remotePilotAddress:15017/inject injectionURL: "" # Revision is set as...

    autoscaleMin: 1
    autoscaleMax: 5
    autoscaleBehavior: {}
    replicaCount: 1
    rollingMaxSurge: 100%
    rollingMaxUnavailable: 25%

    hub: ""
    tag: ""
    variant: ""

    # Can be a full hub/image:tag
    image: pilot
    traceSampling: 1.0

    # Resources for a small pilot install
    resources:
      requests:
        cpu: 500m
        memory: 2048Mi

    autoscaleMin: 1
    autoscaleMax: 5
    autoscaleBehavior: {}
    replicaCount: 1
    rollingMaxSurge: 100%
    rollingMaxUnavailable: 25%
    hub: ""
    tag: ""
    variant: ""
    # Can be a full hub/image:tag
    image: pilot
    traceSampling: 1.0
    # Resources for a small pilot install
    resources:
      requests:
        cpu: 500m
        memory: 2048Mi

{{- else if .Values.cni.repair.deletePods }}
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["delete"]
{{- else if .Values.cni.repair.labelPods }}
  - apiGroups: [""]
    {{- /* pods/status is less privileged than the full pod, and either can label. So use the lower pods/status */}}
    resources: ["pods/status"]
    verbs: ["patch", "update"]
{{- end }}
{{- end }}
---
{{- if .Values.cni.ambient.enabled }}

  exclude:
    - composite literal uses unkeyed fields
  # Which dirs to exclude: issues from them won't be reported.
  # Can use regexp here: `generated.*`, regexp is applied on full path,
  # including the path prefix if one is set.
  # Default dirs are skipped independently of this option's value (see exclude-dirs-use-default).