apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: istiod-default-validator
  labels:
    app: istiod
    istio: istiod
    istio.io/rev: {{ .Values.revision | default "default" | quote }}
    istio.io/tag: "default"
    # Required to make sure this resource is removed
    # when purging Istio resources
    operator.istio.io/component: Pilot
webhooks:
  - name: validation.istio.io

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ template "name" . }}
  labels:
    app: {{ template "name" . }}
    release: {{ .Release.Name }}
    istio.io/rev: {{ .Values.revision | default "default" }}
    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
    operator.istio.io/component: "Cni"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole

---
{{- if (eq .Values.platform "openshift") }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: ztunnel
  labels:
    app: ztunnel
    release: {{ .Release.Name }}
    istio.io/rev: {{ .Values.revision | default "default" }}
    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
rules:
- apiGroups: ["security.openshift.io"]
  resources: ["securitycontextconstraints"]

apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
  namespace: {{ .Release.Namespace }}
  labels:
    app: istiod
    istio.io/rev: {{ .Values.revision | default "default" | quote }}
    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
    operator.istio.io/component: "Pilot"
    release: {{ .Release.Name }}

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ template "name" . }}
  labels:
    app: {{ template "name" . }}
    release: {{ .Release.Name }}
    istio.io/rev: {{ .Values.revision | default "default" }}
    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
    operator.istio.io/component: "Cni"
rules:
- apiGroups: [""]
  resources: ["pods","nodes","namespaces"]

  namespace: {{ .Release.Namespace }}
  {{- if .Values.pilot.serviceAnnotations }}
  annotations:
{{ toYaml .Values.pilot.serviceAnnotations | indent 4 }}
  {{- end }}
  labels:
    istio.io/rev: {{ .Values.revision | default "default" | quote }}
    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
    operator.istio.io/component: "Pilot"
    app: istiod
    istio: pilot

					Contact:      []string{"@istio/maintainers"},
				},
				TimeoutConfig: ctx.Settings().GatewayConformanceTimeoutConfig,
			}
			if rev := ctx.Settings().Revisions.Default(); rev != "" {
				opts.NamespaceLabels = map[string]string{
					"istio.io/rev": rev,
				}
			} else {
				opts.NamespaceLabels = map[string]string{
					"istio-injection": "enabled",
				}
			}
			ctx.Cleanup(func() {

repos:
-   repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.4.0
    hooks:
    -   id: check-added-large-files
    -   id: check-toml
    -   id: check-yaml
        args:
        -   --unsafe
    -   id: end-of-file-fixer
    -   id: trailing-whitespace
-   repo: https://github.com/charliermarsh/ruff-pre-commit
    rev: v0.2.0
    hooks:
    -   id: ruff
        args:
        - --fix

		func(o *admissionregistrationv1.MutatingWebhookConfiguration) []string {
			rev := o.GetLabels()[label.IoIstioRev.Name]
			if rev == "" {
				return nil
			}
			return []string{rev}
		}, controllers.ObjectHandler(p.queue.AddObject))
	return p
}

func (p *tagWatcher) Run(stopCh <-chan struct{}) {

				installRevisionOrFail(t, v, configs)

				// create a namespace pointed to the revisioned control plane we just installed
				rev := strings.ReplaceAll(v, ".", "-")
				ns, err := namespace.New(t, namespace.Config{
					Prefix:   fmt.Sprintf("revision-%s", rev),
					Inject:   true,
					Revision: rev,
				})
				if err != nil {
					t.Fatalf("failed to created revisioned namespace: %v", err)
				}