default   details-v1-698d88b-krdw7       10.244.2.55 ambient-worker2 None     HBONE
default   httpbin-7447985f87-t8hv7       10.244.1.40 ambient-worker  None     TCP
default   productpage-v1-675fc69cf-kkrm2 10.244.2.56 ambient-worker2 None     HBONE
default   ratings-v1-6484c4d9bb-8xc2r    10.244.2.57 ambient-worker2 None     HBONE

      `experimental_default_delegate_latest_features` to enable all default
      delegate features.

* `tf.data`
    * Add `wait` to `tf.data.Dataset.load`. If `True`, for snapshots written
      with `distributed_save`, it reads the snapshot while it is being written.
      For snapshots written with regular `save`, it waits for the snapshot until
      it's finished. The default is `False` for backward compatibility. Users of

        assertTrue(DefaultMirrorSelector.matchesLayout("default", "default,legacy"));

        assertFalse(DefaultMirrorSelector.matchesLayout("default", "legacy,!default"));
        assertFalse(DefaultMirrorSelector.matchesLayout("default", "!default,legacy"));

        assertFalse(DefaultMirrorSelector.matchesLayout("default", "*,!default"));
        assertFalse(DefaultMirrorSelector.matchesLayout("default", "!default,*"));

		if _, err := config.LookupSite(s[config.SiteSubSys][config.Default], s[config.RegionSubSys][config.Default]); err != nil {
			return err
		}
	case config.APISubSys:
		if _, err := api.LookupConfig(s[config.APISubSys][config.Default]); err != nil {
			return err
		}
	case config.BatchSubSys:
		if _, err := batch.LookupConfig(s[config.BatchSubSys][config.Default]); err != nil {
			return err
		}

    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
  annotations: {
    istio.io/rev: {{ .Revision | default "default" | quote }},
    {{- if ge (len $containers) 1 }}

    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
  annotations: {
    istio.io/rev: {{ .Revision | default "default" | quote }},
    {{- if ge (len $containers) 1 }}

kind: ClusterRoleBinding
metadata:
  name: istio-cni
  labels:
    app: istio-cni
    release: {{ .Release.Name }}
    istio.io/rev: {{ .Values.revision | default "default" }}
    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
    operator.istio.io/component: "Cni"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: istio-cni
subjects:
- kind: ServiceAccount

sftp>
```

## Advanced options

### Change default FTP port

Default port '8021' can be changed via

```
--ftp="address=:3021"
```

### Change FTP passive port range

By default FTP requests OS to give a free port automatically, however you may want to restrict
this to specific ports in certain restricted environments via

kind: ClusterRole
metadata:
  name: ztunnel
  labels:
    app: ztunnel
    release: {{ .Release.Name }}
    istio.io/rev: {{ .Values.revision | default "default" }}
    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
rules:
- apiGroups: ["security.openshift.io"]
  resources: ["securitycontextconstraints"]
  resourceNames: ["privileged"]
  verbs: ["use"]
---

    variant: ""

    # Specify image pull policy if default behavior isn't desired.
    # Default behavior: latest images will be Always else IfNotPresent.
    imagePullPolicy: ""

    # change cni scope level to control logging out of istio-cni-node DaemonSet
    logging:
      level: default:info,cni:info

    logAsJson: false

    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace