The MIT License (MIT)

Copyright (c) 2013 Alif Rachmawadi

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is

/*
Copyright The Kubernetes Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,

// Copyright Istio Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,

# Copyright Istio Authors
#
#   Licensed under the Apache License, Version 2.0 (the "License");
#   you may not use this file except in compliance with the License.
#   You may obtain a copy of the License at
#
#       http://www.apache.org/licenses/LICENSE-2.0
#
#   Unless required by applicable law or agreed to in writing, software
#   distributed under the License is distributed on an "AS IS" BASIS,

  // The list ordering isn't significant, may contain duplicates, and possibly be incomplete.
  repeated NonResourceRule nonResourceRules = 2;

  // Incomplete is true when the rules returned by this call are incomplete. This is most commonly
  // encountered when an authorizer, such as an external authorizer, doesn't support rules evaluation.
  optional bool incomplete = 3;

apiVersion: release-notes/v2
kind: feature
area: installation

# issue is a list of GitHub issues resolved in this note.
issue:
- https://github.com/cert-manager/istio-csr/issues/113

docs: []

releaseNotes:
- |
  **Added** values to the Istio Pilot Helm charts for configuring additional container arguments, volumeMounts, and volumes. Can be used in conjunction with cert-manager istio-csr.

upgradeNotes: []

FROM ${ISTIO_BASE_REGISTRY}/base:${BASE_VERSION} as debug

# The following section is used as base image if BASE_DISTRIBUTION=distroless
FROM ${ISTIO_BASE_REGISTRY}/distroless:${BASE_VERSION} as distroless

# This will build the final image based on either debug or distroless from above
# hadolint ignore=DL3006
FROM ${BASE_DISTRIBUTION:-debug}

# install operator binary
ARG TARGETARCH

FROM ${ISTIO_BASE_REGISTRY}/base:${BASE_VERSION} as debug

# The following section is used as base image if BASE_DISTRIBUTION=distroless
FROM ${ISTIO_BASE_REGISTRY}/iptables:${BASE_VERSION} as distroless

# This will build the final image based on either debug or distroless from above
# hadolint ignore=DL3006
FROM ${BASE_DISTRIBUTION:-debug}

WORKDIR /

ARG istio_version

# Install ztunnel.
ARG TARGETARCH

FROM ubuntu:noble

ENV DEBIAN_FRONTEND=noninteractive

# Do not add more stuff to this list that isn't small or critically useful.
# If you occasionally need something on the container do
# sudo apt-get update && apt-get whichever

# hadolint ignore=DL3005,DL3008
RUN apt-get update && \
  apt-get install --no-install-recommends -y \
  ca-certificates \
  curl \
  iptables \
  iproute2 \
  iputils-ping \
  knot-dnsutils \

  // as last seen by the autoscaler.
  // +optional
  optional int32 currentReplicas = 3;

  // desiredReplicas is the desired number of replicas of pods managed by this autoscaler,
  // as last calculated by the autoscaler.
  optional int32 desiredReplicas = 4;

  // currentMetrics is the last read state of the metrics used by this autoscaler.
  // +listType=atomic