// choose to do so.
			//
			// NOTE: This is a warning and not an error because the user may not intend to label their namespace as ambient.
			//
			// e.g. Users are handling ambient redirection per workload rather than at the namespace level.
			if enrollNamespace {
				namespaceIsLabeledAmbient, err := namespaceIsLabeledAmbient(kubeClient, ns)
				if err != nil {

  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
      requests:

				testutils.CompareBytes(t, resultConfig, goldenConfig, goldenFilepath)
			} else if file.Exists(cniConfigFilePath) {
				t.Fatalf("file %s was not deleted", c.configFilename)
			}

			// check if kubeconfig is deleted
			if file.Exists(kubeConfigFilePath) {
				t.Fatal("kubeconfig was not deleted")
			}

			// check if binaries are deleted
			if file.Exists(filepath.Join(cniBinDir, "istio-cni")) {

		wantErr     bool
	}{
		{
			name:        "errors if unable to unmarshal bytes",
			inputFile:   "",
			wantConfigs: 0,
			wantErr:     true,
		},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			cw := &ConfigWriter{}
			cd, _ := os.ReadFile(tt.inputFile)
			err := cw.Prime(cd)
			if cw.configDump == nil {
				if tt.wantConfigs != 0 {

		// If we are filtering on init container exit code and the termination message does not match, exit
		if ec := c.cfg.InitExitCode; ec == 0 || ec == int(state.ExitCode) {
			return true
		}
		return false
	}

	// Only check pods that have the sidecar annotation; the rest can be
	// ignored.
	if c.cfg.SidecarAnnotation != "" {

					}
				}
				if tc.whURL != "" {
					if validationWhConf.URL == nil {
						t.Fatalf("expected validation URL %s, got nil", tc.whURL)
					}
					if *validationWhConf.URL != tc.whURL {
						t.Fatalf("expected validation URL %s, got %s", tc.whURL, *validationWhConf.URL)
					}
				}
				if tc.whCA != "" {
					if string(validationWhConf.CABundle) != tc.whCA {

		// warning *after* it has applied
		if !skipConfirmation {
			_, _ = stderr.Write([]byte(err.Error()))
			if !generate {
				if !util.Confirm("Apply anyways? [y/N]", w) {
					return nil
				}
			}
		}
	}

	if generate {
		_, err := w.Write([]byte(tagWhYAML))
		if err != nil {
			return err
		}
		return nil
	}

	if err := Create(kubeClient, tagWhYAML, istioNS); err != nil {

{{- if .Values.global.remotePilotAddress }}
apiVersion: v1
kind: Service
metadata:
  {{- if .Values.pilot.enabled }}
  # when local istiod is enabled, we can't use istiod service name to reach the remote control plane
  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}-remote
  {{- else }}
  # when local istiod isn't enabled, we can use istiod service name to reach the remote control plane

"nodeAffinityPreferre" }} {{- range $key, $val := .global.arch }} {{- if gt ($val | int) 0 }} - weight: {{ $val | int }} preference: matchExpressions: - key: kubernetes.io/arch operator: In values: - {{ $key | quote }} {{- end }} {{- end }} {{- end }} {{- define "podAntiAffinity" }} {{- if or .podAntiAffinityLabel .podAntiAffinityTermL}} podAntiAffinity: {{- if .podAntiAffinityLabel }} requiredDuringSchedu: {{- include "podAntiAffinityRequi" . }} {{- end }} {{- if .podAntiAffinityTermL }} preferredDuringSched: {{-...

		if r := cmp.Compare(a.Namespace, b.Namespace); r != 0 {
			return r
		}
		if r := cmp.Compare(a.Name, b.Name); r != 0 {
			return r
		}
		return cmp.Compare(a.Hostname, b.Hostname)
	})
	out, err := json.MarshalIndent(svcs, "", "    ")
	if err != nil {
		return fmt.Errorf("failed to marshal workloads: %v", err)
	}
	if outputFormat == "yaml" {
		if out, err = yaml.JSONToYAML(out); err != nil {