cargo build --profile="${BUILD_ZTUNNEL_PROFILE:-dev}" ${BUILD_ZTUNNEL_TARGET:+--target=${BUILD_ZTUNNEL_TARGET}}

  local ZTUNNEL_BIN_PATH
  if [[ "${BUILD_ZTUNNEL_PROFILE:-dev}" == "dev" ]]; then
      ZTUNNEL_BIN_PATH=debug
  else
      ZTUNNEL_BIN_PATH="${BUILD_ZTUNNEL_PROFILE}"
  fi
  ZTUNNEL_BIN_PATH="out/rust/${BUILD_ZTUNNEL_TARGET:+${BUILD_ZTUNNEL_TARGET}/}${ZTUNNEL_BIN_PATH}/ztunnel"

    - type: Resource
      resource:
        name: cpu
        target:
          averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
          type: Utilization
    {{- end }}
    {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
    - type: Resource
      resource:
        name: memory
        target:

# If you want to make a change in this file, edit the original one and run "make gen".

pilot:
  env:
    # 1.22 behavioral changes
    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
meshConfig:
  # 1.22 behavioral changes
  proxyMetadata:
    ISTIO_DELTA_XDS: "false"
  defaultConfig:
    tracing:
      zipkin:

While a user can just explicitly pass this with `--values/-f`.

However, Istio also provides a feature to bundle these with the charts, which is convenient when installing from remote charts.
For details, see `copy-templates` Makefile target, and `manifests/zzz_profile.yaml`.

Any changes to this folder should have a `make copy-templates` applied afterwards.

Warning: unlike the `IstioOperator` profiles, these profiles cannot enable or disable certain components.

    PERSIST_OLDEST_FIRST_HEURISTIC_FOR_VIRTUAL_SERVICE_HOST_MATCHING: "true"
    VERIFY_CERTIFICATE_AT_CLIENT: "false"
    ENABLE_AUTO_SNI: "false"

    # 1.22 behavioral changes
    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"

meshConfig:
  # 1.22 behavioral changes
  defaultConfig:
    proxyMetadata:
      ISTIO_DELTA_XDS: "false"
    tracing:
      zipkin:

# Copy native envoy binary to TARGET_OUT
echo "Copying ${ISTIO_ENVOY_NATIVE_PATH} to ${TARGET_OUT}/${SIDECAR}"
cp -f "${ISTIO_ENVOY_NATIVE_PATH}" "${TARGET_OUT}/${SIDECAR}"

# Copy the envoy binary to TARGET_OUT_LINUX if the local OS is not Linux
if [[ "$GOOS_LOCAL" != "linux" ]]; then
   echo "Copying ${ISTIO_ENVOY_LINUX_RELEASE_PATH} to ${TARGET_OUT_LINUX}/${SIDECAR}"

		LabelSelector: fmt.Sprintf("%s=%s", IstioTagLabel, tag),
	})
	if err != nil {
		return nil, err
	}
	return webhooks.Items, nil
}

// GetWebhooksWithRevision returns webhooks tagged with istio.io/rev=<rev> and NOT TAGGED with istio.io/tag.
// this retrieves the webhook created at revision installation rather than tag webhooks

Next, we terminate the CONNECT.
From the [headers](#headers), we know the target destination.
If the target destination has a waypoint, we enforce that the request is coming from that waypoint. Otherwise, the request is rejected.
If there is no waypoint, ztunnel will enforce RBAC policies against the request.

  // is not namespaced or the request targets all namespaces).
  // If this field is omitted or false then the `namespaces` field
  // must contain a non-empty list.
  // +optional
  optional bool clusterScope = 4;

  // `namespaces` is a list of target namespaces that restricts
  // matches.  A request that specifies a target namespace matches

  // is not namespaced or the request targets all namespaces).
  // If this field is omitted or false then the `namespaces` field
  // must contain a non-empty list.
  // +optional
  optional bool clusterScope = 4;

  // `namespaces` is a list of target namespaces that restricts
  // matches.  A request that specifies a target namespace matches