{{- else }}
          image: "{{ .Values.cni.hub | default .Values.global.hub }}/{{ .Values.cni.image | default "install-cni" }}:{{ .Values.cni.tag | default .Values.global.tag }}{{with (.Values.cni.variant | default .Values.global.variant)}}-{{.}}{{end}}"
{{- end }}
{{- if or .Values.cni.pullPolicy .Values.global.imagePullPolicy }}
          imagePullPolicy: {{ .Values.cni.pullPolicy | default .Values.global.imagePullPolicy }}
{{- end }}

			switch common.outputFormat {
			case summaryOutput:
				return cw.PrintSecretSummary()
			case jsonOutput, yamlOutput:
				return cw.PrintSecretDump(common.outputFormat)
			default:
				return fmt.Errorf("output format %q not supported", common.outputFormat)
			}
		}),
		ValidArgsFunction: completion.ValidPodsNameArgs(ctx),
	}

	common.attach(cmd)

	return cmd
}

		return &corev1.Namespace{
			ObjectMeta: metav1.ObjectMeta{
				Name:   name,
				Labels: labels,
			},
		}
	}
	nss := []runtime.Object{
		createNamespace("default", nil),
		createNamespace("kube-system", nil),
		createNamespace("istio-system", nil),
		createNamespace("ambient", map[string]string{
			constants.DataplaneModeLabel: constants.DataplaneModeAmbient,
		}),

          operator: Exists
      containers:
      - name: istio-proxy
{{- if contains "/" .Values.image }}
        image: "{{ .Values.image }}"
{{- else }}
        image: "{{ .Values.hub }}/{{ .Values.image | default "ztunnel" }}:{{ .Values.tag }}{{with (.Values.variant )}}-{{.}}{{end}}"
{{- end }}
        ports:
        - containerPort: 15020
          name: ztunnel-stats
          protocol: TCP
        resources:

      resources:   ["*"]
    objectSelector:
      matchExpressions:
        - key: istio.io/rev
          operator: In
          values:
          {{- if (eq .Values.revision "") }}
          - "default"
          {{- else }}
          - "{{ .Values.revision }}"
          {{- end }}
  variables:
    - name: isEnvoyFilter
      expression: "object.kind == 'EnvoyFilter'"
    - name: isWasmPlugin

	// APIPA/"link-local" IP.
	//
	// It doesn't matter what this IP is, so long as it's not routable and doesn't collide with anything else.
	//
	// IPv6 link local ranges are designed to be collision-resistant by default, and so probably never need to be overridden
	DefaultHostProbeSNATIP   = "169.254.7.127"
	DefaultHostProbeSNATIPV6 = "fd16:9254:7127:1337:ffff:ffff:ffff:ffff"
)

type AmbientArgs struct {
	SystemNamespace string