} else if podLabel != "" {
				return fmt.Sprintf("Pod label %s matches", podLabel), true
			}
		} else if nsMatched {
			for _, me := range wh.ObjectSelector.MatchExpressions {
				switch me.Operator {
				case metav1.LabelSelectorOpDoesNotExist:
					v, ok := podLabels[me.Key]
					if ok {
						return fmt.Sprintf("Pod has %s=%s label, preventing injection", me.Key, v), false
					}

// limitations under the License.

package mesh

import (
	"fmt"
	"os"
	"path/filepath"

	"github.com/spf13/cobra"

	"istio.io/istio/operator/pkg/compare"
	"istio.io/istio/operator/pkg/util"
)

// YAMLSuffix is the suffix of a YAML file.
const YAMLSuffix = ".yaml"

type manifestDiffArgs struct {
	// compareDir indicates comparison between directory.
	compareDir bool

kind: MutatingWebhookConfiguration
metadata:
  labels:
    app: sidecar-injector
    install.operator.istio.io/owning-resource: example-istiocontrolplane
    install.operator.istio.io/owning-resource-namespace: istio-system
    istio.io/rev: default
    operator.istio.io/component: Pilot
    operator.istio.io/managed: Reconcile
    operator.istio.io/version: 1.14.0
    release: istio
  name: istio-sidecar-injector
webhooks:

    logging:
      level: "default:info"

    omitSidecarInjectorConfigMap: false

    # Configure whether Operator manages webhook configurations. The current behavior
    # of Istiod is to manage its own webhook configurations.
    # When this option is set as true, Istio Operator, instead of webhooks, manages the
    # webhook configurations. When this option is set as false, webhooks manage their

{{- if eq .Values.cni.provider "multus" }}
apiVersion: k8s.cni.cncf.io/v1
kind: NetworkAttachmentDefinition
metadata:
  name: istio-cni
  namespace: default
  labels:
    operator.istio.io/component: "Cni"

  namespace: {{ .Release.Namespace }}
  labels:
    istio.io/rev: {{ .Values.revision | default "default" | quote }}
    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
    operator.istio.io/component: "Pilot"
    release: {{ .Release.Name }}
data:

  # Configuration file for the mesh networks to be used by the Split Horizon EDS.
  meshNetworks: |-

.nodeSelector -}} {{- if or .global.arch $nodeSelector }} nodeSelectorTerms: - matchExpressions: {{- if .global.arch }} - key: kubernetes.io/arch operator: In values: {{- range $key, $val := .global.arch }} {{- if gt ($val | int) 0 }} - {{ $key | quote }} {{- end }} {{- end }} {{- end }} {{- range $key, $val := $nodeSelector }} - key: {{ $key }} operator: In values: - {{ $val | quote }} {{- end }} {{- end }} {{- end }} {{- define "nodeAffinityPreferre" }} {{- range $key, $val := .global.arch }} {{-...

  // react to an unknown operator by assuming the requirement is not satisfied.
  optional string operator = 2;

  // Specifies the set of values. Each returned container exit code (might be
  // multiple in case of multiple containers) is checked against this set of
  // values with respect to the operator. The list of values must be ordered

metadata:
  name: istio-cni
  labels:
    app: istio-cni
    release: {{ .Release.Name }}
    istio.io/rev: {{ .Values.revision | default "default" }}
    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
    operator.istio.io/component: "Cni"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: istio-cni
subjects:
- kind: ServiceAccount
  name: istio-cni

  // associated with "runlevel" of "0" or "1";  you will set the selector as
  // follows:
  // "namespaceSelector": {
  //   "matchExpressions": [
  //     {
  //       "key": "runlevel",
  //       "operator": "NotIn",
  //       "values": [
  //         "0",
  //         "1"
  //       ]
  //     }
  //   ]
  // }
  //
  // If instead you want to only run the webhook on any objects whose