apiVersion: v1
kind: ConfigMap
metadata:
  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
  namespace: {{ .Release.Namespace }}
  labels:
    istio.io/rev: {{ .Values.revision | default "default" | quote }}
    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
    operator.istio.io/component: "Pilot"
    release: {{ .Release.Name }}
data:

	"istio.io/istio/pkg/test/framework/components/istio"
	"istio.io/istio/pkg/test/framework/components/istioctl"
	"istio.io/istio/pkg/test/framework/components/namespace"
	"istio.io/istio/pkg/test/framework/resource"
	"istio.io/istio/pkg/test/framework/resource/config/apply"
	"istio.io/istio/pkg/test/scopes"
	"istio.io/istio/pkg/test/util/file"
	"istio.io/istio/pkg/test/util/retry"
	"istio.io/istio/pkg/test/util/tmpl"

[Unit]
Description=istio-sidecar: The Istio sidecar
Documentation=http://istio.io/
StartLimitIntervalSec=0

[Service]
ExecStart=/usr/local/bin/istio-start.sh
ExecStartPre=+/usr/bin/install -d -o istio-proxy -m 0755 /var/run/secrets
ExecStopPost=/usr/local/bin/istio-start.sh clean
Restart=always
RestartSec=10
KillMode=mixed
TimeoutStopSec=30s

[Install]

	// the command-line, that takes precedence.
	// nolint: revive, stylecheck
	KUBECONFIG Variable = "KUBECONFIG"

	// IstioSrc is the location of istio source ($TOP/src/istio.io/istio
	IstioSrc = REPO_ROOT.ValueOrDefaultFunc(getDefaultIstioSrc)

	// IstioOut is the location of the output directory ($TOP/out)
	IstioOut = verifyFile(TARGET_OUT, TARGET_OUT.ValueOrDefaultFunc(getDefaultIstioOut))

{
  "cniVersion": "0.3.1",
  "name": "istio-cni",
  "type": "istio-cni",
  "ipam": {},
  "dns": {},
  "plugin_log_level": "debug",
  "log_uds_address": "",
  "cni_event_address": "",
  "ambient_enabled": false,
  "kubernetes": {
    "kubeconfig": "/path/to/kubeconfig",
    "exclude_namespaces": [
      ""
    ]
  }

apiVersion: release-notes/v2
kind: feature
area: security
releaseNotes:
- |
  **Improved** Gateway certificates to be read and distributed from Istiod, rather than in the gateway pods.
  This reduces the permissions required in the gateways, improves performance, and will make certificate reading
  more flexible in the future. This change is fully backwards compatible with the old method, and requires no changes

apiVersion: release-notes/v2
kind: feature
area: installation
issue:
  - https://github.com/istio/enhancements/issues/11

releaseNotes:
- |

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  name: test
  namespace: istio-system
spec:
  meshConfig:
    # Set enableTracing to false to disable request tracing.
    enableTracing: true
    # This is the ingress service name, update if you used a different name
    ingressService: istio-ingress
    connectTimeout: 1s
    defaultConfig:
      ### ADVANCED SETTINGS #############

apiVersion: release-notes/v2
kind: feature
area: telemetry
releaseNotes:
- |

```

3) `istio-control/istio-discovery` chart installs a revision of istiod.

```console
 helm install -n istio-system istiod manifests/charts/istio-control/istio-discovery --set profile=openshift
```

4) `gateways` charts install a load balancer with `ingress` and `egress`.

Ingress secrets and access should be separated from the control plane.

```console