"caBundle" .Values.istiodRemote.injectionCABundle
  "namespace" .Release.Namespace }}
{{- define "core" }}
{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
a unique prefix to each. */}}
- name: {{.Prefix}}sidecar-injector.istio.io
  clientConfig:
    {{- if .injectionURL }}
    url: "{{ .injectionURL }}"
    {{- else }}
    service:

	if err != nil {
		return nil, fmt.Errorf("failed creating kube client: %v", err)
	}

	return client, nil
}

// createHostsideProbeIpset creates an ipset. This is designed to be called from the host netns.
// Note that if the ipset already exist by name, Create will not return an error.
//
// We will unconditionally flush our set before use here, so it shouldn't matter.

global.jwtPolicy=first-party-jwt ``` manifests/charts/UPDATING-CHARTS.md # Updating charts and values.yaml ## Acceptable Pull Requests Helm charts `values.yaml` represent a complex user facing API that tends to grow uncontrollably over time due to design choices in Helm. The underlying Kubernetes resources we configure have 1000s of fields; given enough users and bespoke use cases, eventually someone will want to customize every one of those fields. If all fields are exposed in `values.yaml`, we end...

  // index 2 in this pod). This syntax is chosen only to have some well-defined way of
  // referencing a part of an object.
  // TODO: this design is not final and this field is subject to change in the future.
  // +optional
  optional string fieldPath = 7;
}

// PersistentVolume (PV) is a storage resource provisioned by an administrator.

//
// <digit>           ::= 0 | 1 | ... | 9
// <digits>          ::= <digit> | <digit><digits>
// <number>          ::= <digits> | <digits>.<digits> | <digits>. | .<digits>
// <sign>            ::= "+" | "-"
// <signedNumber>    ::= <number> | <sign><number>
// <suffix>          ::= <binarySI> | <decimalExponent> | <decimalSI>
// <binarySI>        ::= Ki | Mi | Gi | Ti | Pi | Ei
//

  // At least one of ipv4 and ipv6 must be specified.
  // This field is immutable.
  // +optional
  optional string ipv6 = 4;
}

// IPAddress represents a single IP of a single IP Family. The object is designed to be used by APIs
// that operate on IP addresses. The object is used by the Service core API for allocation of IP addresses.
// An IP address can be represented in different formats, to guarantee the uniqueness of the IP,

    listKind: IPAddressPoolList
    plural: ipaddresspools
    singular: ipaddresspool
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .spec.autoAssign
      name: Auto Assign
      type: boolean
    - jsonPath: .spec.avoidBuggyIPs
      name: Avoid Buggy IPs
      type: boolean
    - jsonPath: .spec.addresses
      name: Addresses
      type: string
    name: v1beta1

{{/* affinity - https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ */}} {{ define "nodeaffinity" }} nodeAffinity: requiredDuringSchedu: {{- include "nodeAffinityRequired" . }} preferredDuringSched: {{- include "nodeAffinityPreferre" . }} {{- end }} {{- define "nodeAffinityRequired" }} {{- $nodeSelector := default .global.defaultNodeSelector .nodeSelector -}} {{- if or .global.arch $nodeSelector }} nodeSelectorTerms: - matchExpressions: {{- if .global.arch }} - key: kubernetes.io/arch...

	// APIPA/"link-local" IP.
	//
	// It doesn't matter what this IP is, so long as it's not routable and doesn't collide with anything else.
	//
	// IPv6 link local ranges are designed to be collision-resistant by default, and so probably never need to be overridden
	DefaultHostProbeSNATIP   = "169.254.7.127"
	DefaultHostProbeSNATIPV6 = "fd16:9254:7127:1337:ffff:ffff:ffff:ffff"
)

type AmbientArgs struct {

digraph { grpc -> ca [label="Send CSR gRPC Request"] subgraph cluster_istioagent { label = "Istio Agent" color="orange" sds SecretManager -> caClient [label="Sign CSR"] caClient -> grpc grpc -> TokenProvider [dir=none,label="Fetch JWT",color=purple] grpc -> cfiles [dir=none,label="Fetch Cert",color=purple] sds -> SecretManager [label="Generate certificate"] SecretManager -> cfiles [label="Write certs to file"] cfiles [label="Certificate Files"] grpc [shape=diamond] } subgraph cluster_istiod {...