"tag": "istio.authorization.dry_run.allow_policy.name",
               "metadata": {
                "kind": {
                 "request": {}
                },
                "metadata_key": {
                 "key": "envoy.filters.http.rbac",
                 "path": [
                  {
                   "key": "istio_dry_run_allow_shadow_effective_policy_id"
                  }
                 ]

    loadBalancingWeight: 3
    locality: {}
  policy:
    overprovisioningFactor: 140
- clusterName: sds-grpc
  endpoints:
  - lbEndpoints:
    - endpoint:
        address:
          pipe:
            path: ./var/run/secrets/workload-spiffe-uds/socket
        healthCheckConfig: {}
      healthStatus: HEALTHY
      loadBalancingWeight: 1
    locality: {}
  policy:
    overprovisioningFactor: 140

{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
{{ $gateway := index .Values "gateways" "istio-ingressgateway" }}
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: {{ $gateway.name }}
  namespace: {{ .Release.Namespace }}
  labels:
{{ $gateway.labels | toYaml | trim | indent 4 }}
    release: {{ .Release.Name }}
    istio.io/rev: {{ .Values.revision | default "default" | quote }}

# DO NOT EDIT - Generated by Cue OpenAPI generator based on Istio APIs.
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    "helm.sh/resource-policy": keep
  labels:
    app: istio-pilot
    chart: istio
    heritage: Tiller
    release: istio
  name: wasmplugins.extensions.istio.io
spec:
  group: extensions.istio.io
  names:
    categories:
    - istio-io
    - extensions-istio-io

          )
        )
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
  name: "stable-channel-default-policy-binding.istio.io"
spec:
  policyName: "stable-channel-default-policy.istio.io"
  validationActions: [Deny]

      metadata:
        filterMetadata:
          istio:
            workload: istio-ingressgateway;istio-system;istio-ingressgateway;latest;Kubernetes
    loadBalancingWeight: 1
    locality: {}
  policy:
    overprovisioningFactor: 140
- clusterName: outbound|80||skywalking-ui.skywalking.svc.cluster.local
  endpoints:
  - lbEndpoints:
    - endpoint:
        address:
          socketAddress:

lifecycle to apply to gateways as sidecars. Note: this does mean that the namespace the gateway is deployed in must not have the `istio-injection=disabled` label. See [Controlling the injection policy](https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#controlling-the-injection-policy) for more info. ### Examples #### Egress Gateway Deploying a Gateway to be used as an [Egress Gateway](https://istio.io/latest/docs/tasks/traffic-management/egress/egress-gateway/): ```yaml service:...

  tolerations: []

  topologySpreadConstraints: []

  affinity: {}

  # If specified, the gateway will act as a network gateway for the given network.
  networkGateway: ""

  # Specify image pull policy if default behavior isn't desired.
  # Default behavior: latest images will be Always else IfNotPresent
  imagePullPolicy: ""

  imagePullSecrets: []

  # used to pull operator image. Must be set for any cluster configured with private docker registry.
  imagePullSecrets: []

  # Specify image pull policy if default behavior isn't desired.
  # Default behavior: latest images will be Always else IfNotPresent.
  imagePullPolicy: ""

  # Used to replace istioNamespace to support operator watch multiple namespaces.

  resources:
  - horizontalpodautoscalers
  verbs:
  - '*'
- apiGroups:
  - monitoring.coreos.com
  resources:
  - servicemonitors
  verbs:
  - get
  - create
  - update
- apiGroups:
  - policy
  resources:
  - poddisruptionbudgets
  verbs:
  - '*'
- apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - clusterrolebindings
  - clusterroles
  - roles
  - rolebindings
  verbs: