- **Pilot** - Responsible for configuring the proxies at runtime.

    - **Citadel** - Responsible for certificate issuance and rotation.

    - **Galley** - Responsible for validating, ingesting, aggregating, transforming and distributing config within Istio.

- **Operator** - The component provides user friendly options to operate the Istio service mesh.

  // If the finalizer list is processed in order, then this can lead to a situation
  // in which the component responsible for the first finalizer in the list is
  // waiting for a signal (field value, external system, or other) produced by a
  // component responsible for a finalizer later in the list, resulting in a deadlock.
  // Without enforced ordering finalizers are free to order amongst themselves and

apiVersion: v1
name: cni
# This version is never actually shipped. istio/release-builder will replace it at build-time
# with the appropriate version
version: 1.0.0
appVersion: 1.0.0
description: Helm chart for istio-cni components
keywords:
  - istio-cni
  - istio
sources:
  - https://github.com/istio/istio
engine: gotpl

# To simplify the deployment, disable non-essential components
alertmanager:
  enabled: false
prometheus-pushgateway:
  enabled: false
kube-state-metrics:
  enabled: false
prometheus-node-exporter:
  enabled: false
server:
  podLabels:
    sidecar.istio.io/inject: "false"
  persistentVolume:
    enabled: false
  # Use port 9090 to match Istio documentation
  service:
    servicePort: 9090
  readinessProbeInitialDelay: 0

# Simulate the case where the default installation failed, and the user has to reinstall the components.
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  labels:
    app: sidecar-injector
  name: w-istio-sidecar-injector-istio-system

webhooks:
- admissionReviewVersions:
  - v1beta1
  - v1
  clientConfig:
    service:
      name: istiod
      namespace: istio-system
      path: /inject

	tests := []struct {
		desc       string
		configPath string
	}{
		{
			desc: "all_off",
		},
		{
			desc:       "config_path",
			configPath: "components",
		},
		{
			desc:       "list_path",
			configPath: "values.gateways.istio-egressgateway.secretVolumes",
		},
	}
	installPackagePathRegex := regexp.MustCompile("  installPackagePath: .*")

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  components:
    cni:
      enabled: true
      namespace: kube-system
    ztunnel:
      enabled: true
      namespace: kube-system
    ingressGateways:
    - name: istio-ingressgateway
      enabled: false
  values:

apiVersion: v1
name: ztunnel
# This version is never actually shipped. istio/release-builder will replace it at build-time
# with the appropriate version
version: 1.0.0
appVersion: 1.0.0
description: Helm chart for istio ztunnel components
keywords:
  - istio-ztunnel
  - istio
sources:
  - https://github.com/istio/istio
engine: gotpl

    # Download and extract the binary to the output directory.
    echo "Downloading ${SIDECAR}: $1 to $2"
    time ${DOWNLOAD_COMMAND} --header "${AUTH_HEADER:-}" "$1" |\
      tar --extract --gzip --strip-components=3 --to-stdout > "$2"
    chmod +x "$2"

    # Make a copy named just "envoy" in the same directory (overwrite if necessary).
    echo "Copying $2 to $(dirname "$2")/${3}"
    cp -f "$2" "$(dirname "$2")/${3}"

}

// RuntimeClassSpec is a specification of a RuntimeClass. It contains parameters
// that are required to describe the RuntimeClass to the Container Runtime
// Interface (CRI) implementation, as well as any other components that need to
// understand how the pod will be run. The RuntimeClassSpec is immutable.
message RuntimeClassSpec {
  // runtimeHandler specifies the underlying runtime and configuration that the