# If you're looking at this file in a different repo and want to make a change, please go to the
# common-files repo, make the change there and check it in. Then come back to this repo and run
# "make update-common".

# Copyright Istio Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.

# If you're looking at this file in a different repo and want to make a change, please go to the
# common-files repo, make the change there and check it in. Then come back to this repo and run
# "make update-common".

# Copyright Istio Authors. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");

// TODO this should actually create v6 and v6 subsets of type `hash:ip`, add them both to a
// superset of type `list:set` - we can then query the superset directly in iptables (with the same rule),
// and iptables will be smart enough to pick the correct underlying set (v4 or v6, based on context),
// reducing the # of rules we need.
//
// BUT netlink lib doesn't support adding things to `list:set` types yet, and current tagged release

      # UNSTABLE: If enabled, and ambient is enabled, enables ipv6 support
      ipv6: false


    repair:
      enabled: true
      hub: ""
      tag: ""

      # Repair controller has 3 modes. Pick which one meets your use cases. Note only one may be used.
      # This defines the action the controller will take when a pod is detected as broken.

			InitContainerStatus: &corev1.ContainerStatus{
				Name: constants.ValidationContainerName,
				State: corev1.ContainerState{
					Waiting: &corev1.ContainerStateWaiting{
						Reason:  "CrashLoopBackOff",
						Message: "Back-off 5m0s restarting failed blah blah blah",
					},
				},
				LastTerminationState: corev1.ContainerState{
					Terminated: &corev1.ContainerStateTerminated{
						Message:  terminationMessage,

### Writing controllers

  // String that identifies the server's internal version of this object that
  // can be used by clients to determine when objects have changed.
  // Value must be treated as opaque by clients and passed unmodified back to the server.
  // Populated by the system.
  // Read-only.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
  // +optional

  // Indicates that the deployment is paused and will not be processed by the
  // deployment controller.
  // +optional
  optional bool paused = 7;

  // DEPRECATED.
  // The config this deployment is rolling back to. Will be cleared after rollback is done.
  // +optional
  optional RollbackConfig rollbackTo = 8;

  // The maximum time in seconds for a deployment to make progress before it

    release: {{ .Release.Name }}
data:
{{/* Scope the values to just top level fields used in the template, to reduce the size. */}}
  values: |-
{{ $vals := pick .Values "global" "istio_cni" "sidecarInjectorWebhook" "revision" -}}
{{ $pilotVals := pick .Values.pilot "cni" -}}
{{ $vals = set $vals "pilot" $pilotVals -}}
{{ $vals | toPrettyJson | indent 4 }}

# Controllers

Istio has a variety of [controllers](https://kubernetes.io/docs/concepts/architecture/controller/), which basically watch some inputs and do something.
This can be reading from Kubernetes and writing other objects back, writing to proxies over XDS, etc.

Unfortunately, writing controllers is very error prone, even for seemingly simple cases.
To work around this, Istio has a variety of abstractions meant to make writing controllers easier.

## Clients