hub: gcr.io/istio-testing

    # Default tag for Istio images.
    tag: latest

    # Variant of the image to use.
    # Currently supported are: [debug, distroless]
    variant: ""

    # Specify image pull policy if default behavior isn't desired.
    # Default behavior: latest images will be Always else IfNotPresent.
    imagePullPolicy: ""

  // is optional to allow the loadbalancer controller or defaulting logic to
  // specify a global default.
  // +optional
  optional IngressBackend backend = 1;

  // TLS configuration. Currently the Ingress only supports a single TLS
  // port, 443. If multiple members of this list specify different hosts, they
  // will be multiplexed on the same port according to the hostname specified

					return err
				}
				for _, c := range clients {
					k := kube.EnableCrdWatcher(c.client)
					sa.AddRunningKubeSourceWithRevision(k, revisionSpecified, c.remote)
				}
			}

			// If we explicitly specify mesh config, use it.
			// This takes precedence over default mesh config or mesh config from a running Kube instance.
			if meshCfgFile != "" {
				_ = sa.AddFileKubeMeshConfig(meshCfgFile)
			}

  // Defaults to everything.
  // +optional
  optional string fieldSelector = 2;

  // Watch for changes to the described resources and return them as a stream of
  // add, update, and remove notifications. Specify resourceVersion.
  // +optional
  optional bool watch = 3;

  // allowWatchBookmarks requests watch events with type "BOOKMARK".
  // Servers that do not implement bookmarks may ignore this flag and

      serviceAccount:
        # Annotations to add to the service account
        annotations: {}

      ### Advanced options ############
      env: {}
      nodeSelector: {}
      tolerations: []

      # Specify the pod anti-affinity that allows you to constrain which nodes
      # your pod is eligible to be scheduled based on labels on pods that are
      # already running on the node rather than based on labels on nodes.

        # preserving backward compatibility
        # ISTIO_META_REQUESTED_NETWORK_VIEW: ""

      nodeSelector: {}
      tolerations: []

      # Specify the pod anti-affinity that allows you to constrain which nodes
      # your pod is eligible to be scheduled based on labels on pods that are
      # already running on the node rather than based on labels on nodes.

settings (--set meshConfig.enableTracing=true). See documentation for more info:` + url.IstioOperatorSpec
	// ManifestsFlagHelpStr is the command line description for --manifests
	ManifestsFlagHelpStr = `Specify a path to a directory of charts and profiles
(e.g. ~/Downloads/istio-` + baseVersion + `/manifests).
`
)

const (
	ChartsDeprecatedStr         = "Deprecated, use --manifests instead."

  revision: ""

  # The customized CA address to retrieve certificates for the pods in the cluster.
  # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
  caAddress: ""

  # Used to locate istiod.
  istioNamespace: istio-system

  # Configuration log level of ztunnel binary, default is info.
  # Valid values are: trace, debug, info, warn, error

  # to fine tune it or use it with kube-inject.
  config: |-
    # defaultTemplates defines the default template to use for pods that do not explicitly specify a template
    {{- if .Values.sidecarInjectorWebhook.defaultTemplates }}
    defaultTemplates:
{{- range .Values.sidecarInjectorWebhook.defaultTemplates}}
    - {{ . }}
{{- end }}
    {{- else }}

// at least one member of verbs matches the request, (b) at least one
// member of apiGroups matches the request, (c) at least one member of
// resources matches the request, and (d) either (d1) the request does
// not specify a namespace (i.e., `Namespace==""`) and clusterScope is
// true or (d2) the request specifies a namespace and least one member
// of namespaces matches the request's namespace.
message ResourcePolicyRule {