// The set of valid time zone names and the time zone offset is loaded from the system-wide time zone
  // database by the API server during CronJob validation and the controller manager during execution.
  // If no system-wide time zone database can be found a bundled version of the database is used instead.

kubectl create ns istio-system
kubectl apply -f operator/samples/default-install.yaml
```

This installs the controller into the cluster in the istio-operator namespace. The controller in turns installs
the Istio control plane into the istio-system namespace by default.

### Controller (running locally)

          "address": "/10.244.0.2",
          "port": {
            "53": 53,
            "9153": 9153
          }
        },
        "Kubernetes//Pod/kube-system/coredns-5dd5756b68-nzlpw:/10.244.0.3": {
          "workloadUid": "Kubernetes//Pod/kube-system/coredns-5dd5756b68-nzlpw",
          "service": "kube-system/kube-dns.kube-system.svc.cluster.local",
          "address": "/10.244.0.3",

    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
meshConfig:
  # 1.22 behavioral changes
  proxyMetadata:
    ISTIO_DELTA_XDS: "false"
  defaultConfig:
    tracing:
      zipkin:

defaults:
  global:
    # Used to locate istiod.
    istioNamespace: "istio-system"

  base:
    # Validation webhook configuration url
    # For example: https://$remotePilotAddress:15017/validate
    validationURL: ""

  istiodRemote:
    # Sidecar injector mutating webhook configuration url
    # For example: https://$remotePilotAddress:15017/inject
    injectionURL: ""

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: public-gateway
  namespace: istio-system
spec:
  selector:
    istio: gateway
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:

spiffe://cluster.local/ns/istio-system/sa/istiod         Leaf     Available        true           e5dfb59150b2ba7f108d93dcec5aa613     2033-03-22T13:04:57Z     2023-03-21T13:02:57Z
spiffe://cluster.local/ns/istio-system/sa/istiod         Root     Available        false          8a516645c40ce76c2c0d27ab4e2461c1     2022-03-18T13:04:49Z     2022-03-21T13:04:49Z

0::/system.slice/docker-8445c3ca20fac1d8e74854d84a7e6a57297ffb22809098b2816b31a428f2b777.scope/kubelet.slice/kubelet-kubepods.slice/kubelet-kubepods-besteffort.slice/kubelet-kubepods-besteffort-pod863b91d4_4b68_4efa_917f_4b560e3e86aa.slice/cri-containerd-75c7fe7ad0df679971e755bd97b84dd68a32e1eba8e8f99b01ab3c07196a3e4a.scope...

the release name `istio-cni`: ```console helm install istio-cni istio/cni -n kube-system ``` Installation in `kube-system` is recommended to ensure the [`system-node-critical`](https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/) `priorityClassName` can be used. You can install in other namespace only on K8S clusters that allow 'system-node-critical' outside of kube-system. ## Ambient To enable ambient, you need to add `--set cni.ambient.enabled=true`. ###...

{{- if not .Values.global.operatorManageWebhooks }}
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
{{- if eq .Release.Namespace "istio-system"}}
  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
{{- else }}