# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
meshConfig:
  defaultConfig:
    proxyMetadata:
      ISTIO_META_ENABLE_HBONE: "true"
global:
  variant: distroless
pilot:
  env:
    PILOT_ENABLE_AMBIENT: "true"
    CA_TRUSTED_NODE_ACCOUNTS: "istio-system/ztunnel,kube-system/ztunnel"
cni:
  ambient:
    enabled: true

# Ztunnel doesn't use a namespace, so everything here is mostly for ztunnel

	Protocol string  `json:"protocol"`
	Port     *uint16 `json:"port,omitempty"`
}

type Waypoint struct {
	Destination string `json:"destination"`
}

type LoadBalancer struct {
	Mode               string   `json:"mode"`
	RoutingPreferences []string `json:"routingPreferences"`
}

type ZtunnelService struct {
	Name         string         `json:"name"`
	Namespace    string         `json:"namespace"`

# The original version of this file is located at /manifests/helm-profiles directory.
# If you want to make a change in this file, edit the original one and run "make gen".

# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
meshConfig:
  defaultConfig:
    proxyMetadata:
      ISTIO_META_ENABLE_HBONE: "true"
global:
  variant: distroless
pilot:
  env:

			return false
		}
		if tls.Mode == networking.ClientTLSSettings_DISABLE || tls.Mode == networking.ClientTLSSettings_ISTIO_MUTUAL {
			return false
		}
		return tls.CaCertificates == "" && tls.CredentialName == "" && !tls.InsecureSkipVerify.GetValue()
	}
	checkSNI := func(tls *networking.ClientTLSSettings) bool {
		if tls == nil {
			return false
		}

      maxUnavailable: {{ .Values.cni.rollingMaxUnavailable }}
  template:
    metadata:
      labels:
        k8s-app: istio-cni-node
        sidecar.istio.io/inject: "false"
        istio.io/dataplane-mode: none
      annotations:
        sidecar.istio.io/inject: "false"
        # Add Prometheus Scrape annotations
        prometheus.io/scrape: 'true'
        prometheus.io/port: "15014"
        prometheus.io/path: '/metrics'

			// Start ambient controller

			// node agent will spawn a goroutine and watch the K8S API for events,
			// as well as listen for messages from the CNI binary.
			log.Info("Starting ambient node agent with inpod redirect mode")
			ambientAgent, err := nodeagent.NewServer(ctx, watchServerReady, cfg.InstallConfig.CNIEventAddress,
				nodeagent.AmbientArgs{
					SystemNamespace: nodeagent.PodNamespace,
					Revision:        nodeagent.Revision,

      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app: ztunnel
  template:
    metadata:
      labels:
        sidecar.istio.io/inject: "false"
        istio.io/dataplane-mode: none
        app: ztunnel
{{ with .Values.podLabels -}}{{ toYaml . | indent 8 }}{{ end }}
      annotations:
        sidecar.istio.io/inject: "false"
{{ with .Values.podAnnotations -}}{{ toYaml . | indent 8 }}{{ end }}

        istio: istiod
        {{- else }}
        istio: pilot
        {{- end }}
        {{- range $key, $val := .Values.pilot.podLabels }}
        {{ $key }}: "{{ $val }}"
        {{- end }}
        istio.io/dataplane-mode: none
      annotations:
        {{- if .Values.meshConfig.enablePrometheusMerge }}
        prometheus.io/port: "15014"
        prometheus.io/scrape: "true"
        {{- end }}
        sidecar.istio.io/inject: "false"

		if err != nil {
			return err
		}

		outpath := filepath.Join(dest, strings.TrimPrefix(path, src))

		if info.IsDir() {
			os.MkdirAll(outpath, info.Mode())
			return nil
		}
		cpErr := file.AtomicCopy(path, filepath.Dir(outpath), filepath.Base(outpath))
		if cpErr != nil {
			return cpErr
		}

		return nil
	})
}