They are `tar`ed to avoid developer confusion and accidental edits.

## Adding a new version

1. Generate a revisioned IstioOperator for the version with equivalent settings:

```yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  hub: gcr.io/istio-release
  revision: 1-x-y
  components:
    base:
      enabled: false
    pilot:
      enabled: true

	TelemetryNamespace string

	// The IstioOperator spec file to be used for Control plane cluster by default
	PrimaryClusterIOPFile string

	// The IstioOperator spec file to be used for Config cluster by default
	ConfigClusterIOPFile string

	// The IstioOperator spec file to be used for Remote cluster by default
	RemoteClusterIOPFile string

	// The IstioOperator spec file used as the base for all installs

// Because the spec is a customization API, specifying an empty IstioOperatorSpec results in a default Istio
// component values.
//
//	apiVersion: install.istio.io/v1alpha1
//	kind: IstioOperator
//	spec:
//	  profile: default
//	  hub: gcr.io/istio-testing
//	  tag: latest
//	  revision: 1-8-0
//	  meshConfig:
//	    accessLogFile: /dev/stdout
//	    enableTracing: true
//	  components:

		// init two custom gateways with revision
		gateways := [][]byte{iopTestGwData1, iopTestGwData2}
		for i, data := range gateways {
			iop := &v1alpha1.IstioOperator{}
			err := yaml.UnmarshalStrict(data, iop)
			assert.NoError(t, err)
			h := &HelmReconciler{
				client:     cl,
				kubeClient: kube.NewFakeClientWithVersion("24"),
				opts: &Options{

}

// GenIOPFromProfile generates an IstioOperator from the given profile name or path, and overlay YAMLs from user
// files and the --set flag. If successful, it returns an IstioOperator string and struct.
func GenIOPFromProfile(profileOrPath, fileOverlayYAML string, setFlags []string, skipValidation, allowUnknownField bool,
	client kube.Client, l clog.Logger,
) (string, *iopv1alpha1.IstioOperator, error) {

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:

}

// SetStatusComplete updates the status field on the IstioOperator instance based on the resulting err parameter.
func (h *HelmReconciler) SetStatusComplete(status *v1alpha1.InstallStatus) error {
	iop := &istioV1Alpha1.IstioOperator{}
	if err := h.getClient().Get(context.TODO(), config.NamespacedName(h.iop), iop); err != nil {
		return fmt.Errorf("failed to get IstioOperator before updating status due to %v", err)
	}
	iop.Status = status

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  namespace: istio-system
spec:
  values:
    global:
      mountMtlsCerts:
    pilot:

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  profile: default
  components:
    pilot:
      enabled: false
    cni:

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  namespace: istio-system
  name: istio-operator
spec: