required: true
      base_ref:
        description: the base ref
        required: true
      installation_id:
        description: the installation id
        required: false
      resolver_url:
        description: the resolver url to pass results to
        required: true
      resolver_token:
        description: Optional resolver token for resolver service
        required: false
        default: ''

jobs:
  gitStream:

    # when purging Istio resources
    operator.istio.io/component: Pilot
webhooks:
  - name: validation.istio.io
    clientConfig:
      {{- if .Values.base.validationURL }}
      url: {{ .Values.base.validationURL }}
      {{- else }}
      service:
        name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
        namespace: {{ .Values.global.istioNamespace }}

    release: {{ .Release.Name }}
    istio: istiod
    istio.io/rev: {{ .Values.defaultRevision | quote }}
webhooks:
  - name: validation.istio.io
    clientConfig:
      {{- if .Values.base.validationURL }}
      url: {{ .Values.base.validationURL }}
      {{- else }}
      service:
        {{- if (eq .Values.defaultRevision "default") }}
        name: istiod
        {{- else }}
        name: istiod-{{ .Values.defaultRevision }}

oidc: enabled: false configUrl: "https://identity-provider-url/.well-known/openid-configuration" clientId: "minio" clientSecret: "" # Provide existing client secret from the Kubernetes Secret resource, existing secret will have priority over `clientId` and/or `clientSecret`` existingClientSecret: "" existingClientIdKey: "" existingClientSecret: "" claimName: "policy" scopes: "openid,profile,email" redirectUri: "https://console-endpoint-url/oauth_callback" # Can leave empty claimPrefix: "" comment:...

                - NETWORK
                type: string
              url:
                description: URL of a Wasm module or OCI container.
                minLength: 1
                type: string
                x-kubernetes-validations:
                - message: url must have schema one of [http, https, file, oci]
                  rule: 'isURL(self) ? (url(self).getScheme() in ['''', ''http'',

    ipFamilyPolicy: ""
    ipFamilies: []

  base:
    # Used for helm2 to add the CRDs to templates.
    enableCRDTemplates: false

    # Validation webhook configuration url
    # For example: https://$remotePilotAddress:15017/validate
    validationURL: ""
    # Validation webhook caBundle value. Useful when running pilot with a well known cert
    validationCABundle: ""

  "injectionURL" .Values.istiodRemote.injectionURL
  "namespace" .Release.Namespace }}
{{- define "core" }}
- name: {{.Prefix}}sidecar-injector.istio.io
  clientConfig:
    {{- if .injectionURL }}
    url: {{ .injectionURL }}
    {{- else }}
    service:
      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
      namespace: {{ .namespace }}
      path: "/inject"
    {{- end }}
  sideEffects: None

            - name: MINIO_PROMETHEUS_AUTH_TYPE
              value: "public"
            {{- end }}
            {{- if .Values.oidc.enabled }}
            - name: MINIO_IDENTITY_OPENID_CONFIG_URL
              value: {{ .Values.oidc.configUrl }}
            - name: MINIO_IDENTITY_OPENID_CLIENT_ID
            {{- if and .Values.oidc.existingClientSecretName .Values.oidc.existingClientIdKey }}
              valueFrom:

## See https://min.io/docs/minio/linux/operations/external-iam/configure-openid-external-identity-management.html for a tutorial on using these variables.
oidc:
  enabled: false
  configUrl: "https://identity-provider-url/.well-known/openid-configuration"
  clientId: "minio"
  clientSecret: ""
  # Provide existing client secret from the Kubernetes Secret resource, existing secret will have priority over `clientId` and/or `clientSecret``

          - "!**/tools/bug-report/**"
          # This should only really import operator API, but that is hard to express without a larger refactoring
          - "!**/pkg/kube/**"
          - "!**/pkg/url/**"
          - "!**/pkg/test/framework/**"
          - "!**/tests/fuzz/**"
        deny:
          - pkg: istio.io/istio/operator
            desc: "operator should not be imported"