appfiles -> appwp
  appfiles -> ig
  appfiles -> nwc
  ztunchart[label="ztunnel",class="helm"]
  ztunnel -> ztunchart -> ztunnelds
  istiodchart[label="istiod",class="helm"]
  cpt -> istiodchart
  istiodchart -> istiod18
  istiodchart -> istiod19
  cnichart[label="cni",class="helm"]
  cni -> cnichart -> cnids
  istiogh[label="istio github"]
  extras -> istiogh -> extrads
  tagchart[label="tag*"]
  edge[weight=1]

		name    string
		input   map[string]*discovery.DiscoveryResponse
		want    string
		wantErr bool
	}{
		{
			name: "prints multiple istiod inputs to buffer in alphabetical order by pod name",
			input: map[string]*discovery.DiscoveryResponse{
				"istiod1": xdsResponseInput("istiod1", []clientConfigInput{
					{
						proxyID:        "proxy1",
						clusterID:      "cluster1",
						version:        "1.20",

NAME       CLUSTER      CDS          LDS         EDS         RDS          ECDS         ISTIOD      VERSION
proxy1     cluster1     STALE        SYNCED      SYNCED      NOT SENT     SYNCED       istiod1     1.20
proxy2     cluster2     STALE        SYNCED      STALE       SYNCED       STALE        istiod2     1.19
proxy3     cluster3     NOT SENT     ERROR       STALE       NOT SENT     NOT SENT     istiod3     1.20

      hosts:
        - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: istiod-vs
spec:
  hosts:
  - "*"
  gateways:
  - istiod-gateway
  tls:
  - match:
    - port: 15012
      sniHosts:
      - "*"
    route:
    - destination:
        host: istiod.istio-system.svc.cluster.local
        port:
          number: 15012
  - match:
    - port: 15017
      sniHosts:

      hosts:
      # use a valid gateway host and domain for istiod
      - "ISTIOD-HOST.DOMAIN"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: istiod-vs
spec:
  hosts:
  # use a valid gateway host and domain for istiod
  - "ISTIOD-HOST.DOMAIN"
  gateways:
  - istiod-gateway
  http:
  - match:
    - port: 15012
    route:
    - destination:

apiVersion: release-notes/v2
kind: feature
area: security
releaseNotes:
- |
  **Improved** Gateway certificates to be read and distributed from Istiod, rather than in the gateway pods.
  This reduces the permissions required in the gateways, improves performance, and will make certificate reading
  more flexible in the future. This change is fully backwards compatible with the old method, and requires no changes

apiVersion: release-notes/v2
kind: feature
area: telemetry
releaseNotes:
- |
  **Added** a new metric (`istiod_managed_clusters`) to `istiod` to track the number of clusters managed by an

				istiodID:              cp.ID,
				istiodVersion:         meta.IstioVersion,
				clusterStatus:         cds,
				listenerStatus:        lds,
				routeStatus:           rds,
				endpointStatus:        eds,
				extensionconfigStatus: ecds,
			})
			if len(fullStatus) == 0 {
				return nil, nil, fmt.Errorf("no proxies found (checked %d istiods)", len(drs))
			}

kind: VirtualService
metadata:
  name: istiod-vs-{{.Revision}}
spec:
  hosts:
  - "*"
  gateways:
  - istiod-gateway
  tls:
  - match:
    - port: 15012
      sniHosts:
      - "istiod-{{.Revision}}.istio-system.svc"
      - "istiod-{{.Revision}}.istio-system.svc.cluster.local"
    route:
    - destination:
        host: istiod-{{.Revision}}.istio-system.svc.cluster.local
        port:

{{ $vals = set $vals "pilot" $pilotVals -}}
{{ $vals | toPrettyJson | indent 4 }}

  # To disable injection: use omitSidecarInjectorConfigMap, which disables the webhook patching
  # and istiod webhook functionality.
  #
  # New fields should not use Values - it is a 'primary' config object, users should be able
  # to fine tune it or use it with kube-inject.
  config: |-