#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#   See the License for the specific language governing permissions and
#   limitations under the License.

function write_patch_file() {
    if [ -z "${ARTIFACTS}" ]; then
      return 0
    fi

    PATCH_NAME="check-clean-repo-diff.patch"
    PATCH_OUT="${ARTIFACTS}/${PATCH_NAME}"
    git diff > "${PATCH_OUT}"

UPDATE_BRANCH=${UPDATE_BRANCH:-"master"}

SCRIPTPATH="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
ROOTDIR=$(dirname "${SCRIPTPATH}")
cd "${ROOTDIR}"

# Get the sha of top commit
# $1 = repo
function getSha() {
  git ls-remote "https://github.com/istio/${1}.git" "refs/heads/${UPDATE_BRANCH}" | cut -f 1
}

make update-common

export GO111MODULE=on
go get -u "istio.io/api@${UPDATE_BRANCH}"

type MessageThreshold struct {
	diag.Level
}

// String is a function declared in the pflag.Value interface
func (m *MessageThreshold) String() string {
	return m.Level.String()
}

// Type is a function declared in the pflag.Value interface
func (m *MessageThreshold) Type() string {
	return "Level"
}

// Set is a function declared in the pflag.Value interface
func (m *MessageThreshold) Set(s string) error {

      # minAvailable: 1

    # A minimal set of requested resources to applied to all deployments so that
    # Horizontal Pod Autoscaler will be able to function (if set).
    # Each component can overwrite these default values by adding its own resources
    # block in the relevant section below and setting the desired resources values.
    defaultResources:
      requests:

				log.Debugf("ignoring error deleting optional iptables rule: %v", err)
			}
		}
	}
	return errors.Join(delErrs...)
}

// Setup iptables rules for in-pod mode. Ideally this should be an idempotent function.
// NOTE that this expects to be run from within the pod network namespace!
func (cfg *IptablesConfigurator) CreateInpodRules(hostProbeSNAT *netip.Addr) error {
	// Append our rules here

  // and appends those labels to the pod template.  When true,
  // the user is responsible for picking unique labels and specifying
  // the selector.  Failure to pick a unique label may cause this
  // and other jobs to not function correctly.  However, You may see
  // `manualSelector=true` in jobs that were created with the old `extensions/v1beta1`
  // API.

      {{- end }}
    {{- /* If someone ends up with this new template, but an older Istiod image, they will attempt to render this template
         which will fail with "Pod injection failed: template: inject:1: function "Istio_1_9_Required_Template_And_Version_Mismatched" not defined".
         This should make it obvious that their installation is broken.
     */}}

	"fmt"
	"strings"

	"sigs.k8s.io/yaml"

	"istio.io/istio/pkg/maps"
	"istio.io/istio/pkg/slices"
)

// ServiceFilter is used to pass filter information into service based config writer print functions
type ServiceFilter struct {
	Namespace string
}

// Verify returns true if the passed workload matches the filter fields
func (wf *ServiceFilter) Verify(svc *ZtunnelService) bool {
	if wf.Namespace != "" {

which is used to # ensure Istio control plane components are gradually upgraded or recovered. defaultPodDisruption: enabled: true # A minimal set of requested resources to applied to all deployments so that # Horizontal Pod Autoscaler will be able to function (if set). # Each component can overwrite these default values by adding its own resources # block in the relevant section below and setting the desired resources values. defaultResources: requests: cpu: 10m # memory: 128Mi # limits: # cpu: 100m #...

// sleepWatchInstall blocks until any file change for the binaries or config are detected.
// At that point, the func yields so the caller can recheck the validity of the install.
// If an error occurs or context is canceled, the function will return an error.
func (in *Installer) sleepWatchInstall(ctx context.Context, installedBinFiles sets.String) error {
	// Watch our specific binaries, in each configured binary dir.