{{- end }}
    {{- /* If someone ends up with this new template, but an older Istiod image, they will attempt to render this template
         which will fail with "Pod injection failed: template: inject:1: function "Istio_1_9_Required_Template_And_Version_Mismatched" not defined".
         This should make it obvious that their installation is broken.
     */}}

    steps:
    - name: Checkout code
      uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0
    - name: Update the RBE Configs
      run: |
        function map() {
          # The "digest" that allows us to pull an image is not the digest as
          # returned by the API, but a sha256sum of the entire chunk of image

    validations:
      required: true

  - type: textarea
    id: actual-behavior
    attributes:
      label: "What did you see happen?"
      description: Command invocations and their associated output, functions with their arguments and return results, full stacktraces for panics (upload a file if it is very long), etc. Prefer copying text output over using screenshots.
    validations:
      required: true

  - type: textarea

      {{- end }}
    {{- /* If someone ends up with this new template, but an older Istiod image, they will attempt to render this template
         which will fail with "Pod injection failed: template: inject:1: function "Istio_1_9_Required_Template_And_Version_Mismatched" not defined".
         This should make it obvious that their installation is broken.
     */}}

-  extern __typeof (name) aliasname __attribute__ ((alias (#name)));
+  extern __typeof (name) aliasname __attribute__ ((alias (#name))) \
+    __attribute_copy__ (name);
 
 /* This comes between the return type and function name in
    a function definition to make that definition weak.  */
@@ -125,14 +131,16 @@
    If weak aliases are not available, this defines a strong alias.  */
 # define weak_alias(name, aliasname) _weak_alias (name, aliasname)

            runAsGroup: 0
            runAsUser: 0
            runAsNonRoot: false
            # Both ambient and sidecar repair mode require elevated node privileges to function.
            # But we don't need _everything_ in `privileged`, so drop+readd capabilities based on feature.
            # privileged is redundant with CAP_SYS_ADMIN