Xiaopeng Han <******@****.***> 1686841337 +0800

* mangle
-N ISTIO_DIVERT
-N ISTIO_TPROXY
-N ISTIO_INBOUND
-A ISTIO_DIVERT -j MARK --set-mark 1337
-A ISTIO_DIVERT -j ACCEPT
-A ISTIO_TPROXY ! -d 127.0.0.1/32 -p tcp -j TPROXY --tproxy-mark 1337/0xffffffff --on-port 15006
-A PREROUTING -p tcp -j ISTIO_INBOUND
-A ISTIO_INBOUND -p tcp --dport 15020 -j RETURN
-A ISTIO_INBOUND -p tcp --dport 15021 -j RETURN
-A ISTIO_INBOUND -p tcp --dport 15090 -j RETURN

		Containers:        sets.New[string](),
		Labels:            pod.Labels,
		Annotations:       pod.Annotations,
		ProxyEnvironments: make(map[string]string),
	}
	for _, c := range containers(pod) {
		pi.Containers.Insert(c.Name)
		if c.Name == ISTIOPROXY {
			// don't include ports from istio-proxy in the redirect ports
			// Get proxy container env variable, and extract out ProxyConfig from it.
			for _, e := range c.Env {

        {{ end }}
    {{- end }}
  {{- else }}
    {{- if .Values.global.proxy.resources }}
      {{ toYaml .Values.global.proxy.resources | indent 6 }}
    {{- end }}
  {{- end }}
{{- end }}
{{- $containers := list }}

      {{- include "podAntiAffinity" $gateway | indent 6 }}
{{- if $gateway.tolerations }}
      tolerations:
{{ toYaml $gateway.tolerations | indent 6 }}
{{- else if .Values.global.defaultTolerations }}
      tolerations:
{{ toYaml .Values.global.defaultTolerations | indent 6 }}
{{- end }}

                          enum:
                          - INVALID
                          - MERGE
                          - ADD
                          - REMOVE
                          - INSERT_BEFORE
                          - INSERT_AFTER
                          - INSERT_FIRST
                          - REPLACE

Xiaopeng Han <******@****.***> 1686841337 +0800

maxSurge: 1 maxUnavailable: 0 selector: matchLabels: app: ztunnel template: metadata: labels: sidecar.istio.io/inject: "false" app: ztunnel {{ with .Values.podLabels -}}{{ toYaml . | indent 8 }}{{ end }} annotations: cni.projectcalico.org/allowedSourcePrefixe: "[\"0.0.0.0/0\"]" ambient.istio.io/redirection: disabled sidecar.istio.io/inject: "false" {{ with .Values.podAnnotations -}}{{ toYaml . | indent 8 }}{{ end }} spec: nodeSelector: kubernetes.io/os: linux serviceAccountName: ztunnel tolerations: - effect:...

}

func readInjectConfigFile(f []byte) (inject.RawTemplates, error) {
	var injectConfig inject.Config
	err := yaml.Unmarshal(f, &injectConfig)
	if err != nil || len(injectConfig.RawTemplates) == 0 {
		// This must be a direct template, instead of an inject.Config. We support both formats
		return map[string]string{inject.SidecarTemplateName: string(f)}, nil
	}
	cfg, err := inject.UnmarshalConfig(f)
	if err != nil {

Xiaopeng Han <******@****.***> 1686841337 +0800