1. The builtin values.yaml defaults
2. The profile the user selects
3. Users input (-f or --set)

Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).

However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
We can then merge the profile onto the defaults, then the user settings onto that.

  // Decompose the directory components given the output/source directories.
  //
  // Be flexible; accept any path string with a "tensorflow" directory name.
  // (It's hard to construct a location-agnostic include path string using the
  // build system, so we accept an example, such as the source build target.)

  tf_root_dir = "tensorflow";

		hardResources := quota.ResourceNames(resourceQuota.Status.Hard)
		requestedUsage := quota.Mask(deltaUsage, hardResources)
		newUsage := quota.Add(resourceQuota.Status.Used, requestedUsage)
		maskedNewUsage := quota.Mask(newUsage, quota.ResourceNames(requestedUsage))

		if allowed, exceeded := quota.LessThanOrEqual(maskedNewUsage, resourceQuota.Status.Hard); !allowed {
			failedRequestedUsage := quota.Mask(requestedUsage, exceeded)

        JvmOptions jvmOptions = new JvmOptions(fileCollectionFactory);
        // TODO(mlopatkin) figure out a nicer way of handling the presence of agent in the foreground daemon.
        //  Currently it is hard to have a proper "-javaagent:/path/to/jar" in clients that start the daemon, so all code deals with a boolean flag shouldApplyAgent instead.

	// if the consumer falls behind. Unittests will hard timeout in 5m.
	var slices []*discoveryv1.EndpointSlice
	for {
		select {
		case slices = <-h.updated:
			if reflect.DeepEqual(slices, expectedSlices) {
				return
			}
		// Unittests will hard timeout in 5m with a stack trace, prevent that
		// and surface a clearer reason for failure.

	conn := sg.Server.getProxyConnection(proxyID)
	if conn == nil {
		// This is "like" a 404.  The error is the client's.  However, this endpoint
		// only tracks a single "shard" of connections.  The client may try another instance.
		return nil, fmt.Errorf("config dump could not find connection for proxyID %q", proxyID)
	}

	dump, err := sg.Server.connectionConfigDump(conn, false)

          - "!**/operator/**"
          - "!**/istioctl/**"
          - "!**/tools/bug-report/**"
          # This should only really import operator API, but that is hard to express without a larger refactoring
          - "!**/pkg/kube/**"
          - "!**/pkg/url/**"
          - "!**/pkg/test/framework/**"
          - "!**/tests/fuzz/**"
        deny:

func (c *configFactory) WaitForConfigOrFail(ctx resource.Context, t test.Failer, ns string, yamlText ...string) {
	err := c.WaitForConfig(ctx, ns, yamlText...)
	if err != nil {
		// TODO(https://github.com/istio/istio/issues/37148) fail hard in this case
		t.Log(err)
	}
}

func (c *configFactory) withFilePrefix(prefix string) config.Factory {
	return &configFactory{
		ctx:      c.ctx,
		prefix:   prefix,
		clusters: c.clusters,
	}

      path: _test.go$

    {{- if .Base}}

    # TODO(oscr) Remove these excluded directories and fix findings. Due to large amount of findings in different components
    # with different owners it's hard to fix everything in a single pr. This will therefore be done in multiple prs.
    - path: (pkg/volume/*|test/*|azure/*|pkg/cmd/wait*|request/bearertoken/*|metrics/*|filters/*)
      linters:
        - gocritic
    {{- end}}

		return fmt.Errorf("failed to exec 'git checkout %s': %s: %v", b.revision, output, err)
	}
	if output, err := b.execCommand("git", []string{"reset", "--hard"}, subdir); err != nil {
		return fmt.Errorf("failed to exec 'git reset --hard': %s: %v", output, err)
	}

	volume.SetVolumeOwnership(b, dir, mounterArgs.FsGroup, nil /*fsGroupChangePolicy*/, volumeutil.FSGroupCompleteHook(b.plugin, nil))