injection labels.`,
		Example: `  # Create a revision tag from the "1-8-0" revision
  istioctl tag set prod --revision 1-8-0

  # Point namespace "test-ns" at the revision pointed to by the "prod" revision tag
  kubectl label ns test-ns istio.io/rev=prod

  # Change the revision tag to reference the "1-8-1" revision
  istioctl tag set prod --revision 1-8-1 --overwrite

- CAP_SYS_ADMIN
- CAP_NET_ADMIN
- CAP_NET_RAW

## Ambient mode details

          securityContext:
          {{- if .Values.containerSecurityContext }}
            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
          {{- else }}
            capabilities:
              drop:
              - ALL
            allowPrivilegeEscalation: false
            privileged: false
            readOnlyRootFilesystem: true
            {{- if not (eq .Values.platform "openshift") }}

          capabilities:
            drop:
            - ALL
          allowPrivilegeEscalation: false
          privileged: false
          readOnlyRootFilesystem: true
          runAsUser: {{ .ProxyUID | default "1337" }}
          runAsGroup: {{ .ProxyGID | default "1337" }}
          runAsNonRoot: true
        {{- else }}
          capabilities:
            drop:
            - ALL
            add:

      - name: istio-proxy
        ports:
        - containerPort: 15021
          name: status-port
          protocol: TCP
        - containerPort: 15090
          protocol: TCP
          name: http-envoy-prom
        {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"

              protocol: {{ $val.protocol | default "TCP" }}
            {{- end }}
            - containerPort: 15090
              protocol: TCP
              name: http-envoy-prom
          args:
          - proxy
          - router
          - --domain
          - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
        {{- if .Values.global.proxy.logLevel }}

  {{ $prom := include "default-prometheus" . | eq "true" }}
  {{ $sdMetrics := include "default-sd-metrics" . | eq "true" }}
  {{ $sdLogs := include "default-sd-logs" . | eq "true" }}
  {{- if or $prom $sdMetrics $sdLogs }}
    defaultProviders:
    {{- if or $prom $sdMetrics }}
      metrics:
      {{ if $prom }}- prometheus{{ end }}

	"github.com/prometheus/procfs"
	"github.com/vishvananda/netlink"
	"golang.org/x/sys/unix"
	corev1 "k8s.io/api/core/v1"

	"istio.io/istio/pkg/log"
)

func getPidNamespace(pid int) string {
	return "/host/proc/" + strconv.Itoa(pid) + "/ns/net"
}

func runInHost[T any](f func() (T, error)) (T, error) {
	var res T
	ns, err := netns.GetNS(getPidNamespace(1))
	if err != nil {

  # Speed up scraping a bit from the default
  global:
    scrape_interval: 15s

  # Match legacy addon deployment
  fullnameOverride: prometheus

  # use dockerhub
  image:
    repository: prom/prometheus

  securityContext: null

configmapReload:
  prometheus:
    image:
      # Use ghcr

should be locked down and restricted.  The new installer allows multiple instances of
policy/control/telemetry - so testing/staging of new settings and versions can be performed
by a different role than the prod version.

The intended users of this repo are users running Istio in production who want to select, tune
and understand each binary that gets deployed, and select which combination to use.