apiVersion: v2
name: istio-operator
# This version is never actually shipped. istio/release-builder will replace it at build-time
# with the appropriate version
version: 1.0.0
appVersion: 1.0.0
description: Helm chart for deploying Istio operator
keywords:
  - istio
  - operator
sources:
  - https://github.com/istio/istio/tree/master/operator

						output, _, err := istioCtl.Invoke(args.args)
						if err != nil {
							return err
						}

						// Just verify pod A is known to Pilot; implicitly this verifies that
						// the printing code printed it.
						if err := expectSubstrings(output, fmt.Sprintf("%s.%s", podName, namespace)); err != nil {
							return err
						}
					}
					return nil
				})

				// Test gRPC-based --xds-via-agents

# If you're looking at this file in a different repo and want to make a change, please go to the
# common-files repo, make the change there and check it in. Then come back to this repo and run
# "make update-common".

ignored:
  - DL3008
  - DL3059

trustedRegistries:
  - gcr.io
  - docker.io
  - quay.io
  - "*.pkg.dev"

	SelectorString string

	// The regex specifying which tests to skip. This follows inverted semantics of golang's
	// -test.run flag, which only supports positive match. If an entire package is meant to be
	// excluded, it can be filtered with `go list` and explicitly passing the list of desired
	// packages. For example: `go test $(go list ./... | grep -v bad-package)`.
	SkipString  ArrayFlags
	SkipMatcher *Matcher

)

// Analyze implements Analyzer
func (s *ExternalControlPlaneAnalyzer) Analyze(c analysis.Context) {
	reportWebhookURL := func(r *resource.Instance, hName string, clientConf v1.WebhookClientConfig) {
		// If defined, it means that an external istiod has been adopted
		if clientConf.URL != nil {
			result, err := lintWebhookURL(*clientConf.URL)
			if err != nil {

          pid="$$$$"

          # Run the pilot agent and Envoy
          # TODO: run with systemctl?
          # Setup a script to start istio but exit the container if it exits. This more closely mirrors Pods.
          # This is not strictly needed, but it makes our CI properly report crashes (including core dumps)
          cat <<'EOF'>/tmp/start.sh
          #!/bin/bash
          /usr/local/bin/istio-start.sh
          kill "$1"

	log.Debugf("netns: %s", addCmd.Netns)

	// The CNI node plugin should have already checked the pod against the k8s API before forwarding us the event,
	// but we have to invoke the K8S client anyway, so to be safe we check it again here to make sure we get the same result.
	ambientPod, err := s.getPodWithRetry(log, addCmd.PodName, addCmd.PodNamespace)
	if err != nil {
		return err
	}

          - extensions.istio.io
        apiVersions:
          - "*"
        resources:
          - "*"

    {{- if .Values.base.validationCABundle }}
    # Disable webhook controller in Pilot to stop patching it
    failurePolicy: Fail
    {{- else }}
    # Fail open until the validation webhook is ready. The webhook controller
    # will update this to `Fail` and patch in the `caBundle` when the webhook
    # endpoint is ready.

	if netns1 != netnsTaken {
		t.Fatalf("Expected the original Netns for the same uid, got %p and %p", netns1, ns)
	}
	if nil != p.Take(string(pod.UID)) {
		// expect nil because we already took it
		t.Fatalf("Expected nil Netns for the same uid twice")
	}
}

var counter atomic.Int64

func inc() uintptr {
	return uintptr(counter.Add(1))

          - extensions.istio.io
        apiVersions:
          - "*"
        resources:
          - "*"

    {{- if .Values.base.validationCABundle }}
    # Disable webhook controller in Pilot to stop patching it
    failurePolicy: Fail
    {{- else }}
    # Fail open until the validation webhook is ready. The webhook controller
    # will update this to `Fail` and patch in the `caBundle` when the webhook
    # endpoint is ready.