failurePolicy: Fail
  reinvocationPolicy: "{{ .reinvocationPolicy }}"
  admissionReviewVersions: ["v1beta1", "v1"]
{{- end }}
{{- /* Installed for each revision - not installed for cluster resources ( cluster roles, bindings, crds) */}}
{{- if not .Values.global.operatorManageWebhooks }}
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
{{- if eq .Release.Namespace "istio-system"}}

#### CRD Watcher

For watches against custom types (CRDs), we want to gracefully handle missing CRDs. Naively starting informers against the missing types would result in errors and blocking startup. Instead, we introduce a "CRD Watcher" component that watches the CRDs in the cluster to determine if they are available or not.

This is consumed in two ways:

		}

		f := l.FilterChains[0].Filters[0]
		cfg, _ := conversion.MessageToStruct(f.GetTypedConfig())
		rds := cfg.Fields["rds"].GetStructValue().Fields["route_config_name"].GetStringValue()
		if rds != "8080" {
			t.Fatalf("expect routes %s, found %s", "8080", rds)
		}

		l = findListenerByAddress(listeners, "1.2.3.4")
		if l == nil {
			t.Fatalf("expect listener %s", "1.2.3.4_8080")
		}

	Terminating CustomResourceDefinitionConditionType = "Terminating"
	// KubernetesAPIApprovalPolicyConformant indicates that an API in *.k8s.io or *.kubernetes.io is or is not approved.  For CRDs
	// outside those groups, this condition will not be set.  For CRDs inside those groups, the condition will
	// be true if .metadata.annotations["api-approved.kubernetes.io"] is set to a URL, otherwise it will be false.

		}, 1)
		tracker.WaitOrdered("add/name")
	})
	t.Run("CRD not ready", func(t *testing.T) {
		stop := test.NewStop(t)
		c := kube.NewFakeClient()

		// Client created before CRDs are ready
		wasm := kclient.NewDelayedInformer[controllers.Object](c, gvr.WasmPlugin, kubetypes.StandardInformer, kubetypes.Filter{})
		tracker := assert.NewTracker[string](t)

      + timeSeries.standardOptions.withOverrides([
        overrideSeries('cds', 'Clusters'),
        overrideSeries('eds', 'Endpoints'),
        overrideSeries('lds', 'Listeners'),
        overrideSeries('rds', 'Routes'),
        overrideSeries('istio.io/debug', 'Debug'),
        overrideSeries('wads', 'Authorization'),
        overrideSeries('wds', 'Workloads'),
      ]),
  },

  heatmap: {

							HttpFilters: filters,
							RouteSpecifier: &hcm.HttpConnectionManager_Rds{
								// TODO: for TCP listeners don't generate RDS, but some indication of cluster name.
								Rds: &hcm.Rds{
									ConfigSource: &core.ConfigSource{
										ConfigSourceSpecifier: &core.ConfigSource_Ads{
											Ads: &core.AggregatedConfigSource{},
										},
									},

		watched *model.WatchedResource) ([]*discovery.Resource, []string, model.XdsLogDetails, bool)

	// BuildHTTPRoutes returns the list of HTTP routes for the given proxy. This is the RDS output
	BuildHTTPRoutes(node *model.Proxy, req *model.PushRequest, routeNames []string) ([]*discovery.Resource, model.XdsLogDetails)

	// BuildNameTable returns list of hostnames and the associated IPs

	}

	if _, err := store.Create(config.Config{
		Meta: configMeta,
		Spec: pb,
	}); err != nil {
		t.Fatalf("Create => got %v", err)
	}

	return pb
}

// Ensure that the client can run without CRDs present
func TestClientNoCRDs(t *testing.T) {
	schema := collection.NewSchemasBuilder().MustAdd(collections.Sidecar).Build()
	store, _ := makeClient(t, schema, nil)

	_, err := shell.Execute(false, execCmd)
	if err != nil {
		ctx.Fatalf("couldn't run kubectl apply on crds folder: %v", err)
	}

	// Upgrade base chart
	err = h.UpgradeChart(helmtest.BaseReleaseName, filepath.Join(helmtest.ManifestsChartPath, helmtest.BaseChart),
		nsConfig.Get(helmtest.BaseReleaseName), overrideValuesFile, helmtest.Timeout, "--skip-crds")
	if err != nil {
		ctx.Fatalf("failed to upgrade istio %s chart", helmtest.BaseReleaseName)
	}