// as pods that have status.conditions item with type="Ready",status="True".
  //
  // Valid policies are IfHealthyBudget and AlwaysAllow.
  // If no policy is specified, the default behavior will be used,
  // which corresponds to the IfHealthyBudget policy.
  //
  // IfHealthyBudget policy means that running pods (status.phase="Running"),
  // but not yet healthy can be evicted only if the guarded application is not

          )
        )
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
  name: "stable-channel-default-policy-binding.istio.io"
spec:
  policyName: "stable-channel-default-policy.istio.io"
  validationActions: [Deny]

  // If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ].
  // Likewise, if you want to write a policy that specifies that no egress is allowed,
  // you must specify a policyTypes value that include "Egress" (since such a policy would not include
  // an egress section and would otherwise default to just [ "Ingress" ]).

{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
{{ $gateway := index .Values "gateways" "istio-ingressgateway" }}
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: {{ $gateway.name }}
  namespace: {{ .Release.Namespace }}
  labels:
{{ $gateway.labels | toYaml | trim | indent 4 }}
    release: {{ .Release.Name }}
    istio.io/rev: {{ .Values.revision | default "default" | quote }}

# DO NOT EDIT - Generated by Cue OpenAPI generator based on Istio APIs.
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    "helm.sh/resource-policy": keep
  labels:
    app: istio-pilot
    chart: istio
    heritage: Tiller
    release: istio
  name: wasmplugins.extensions.istio.io
spec:
  group: extensions.istio.io
  names:
    categories:
    - istio-io
    - extensions-istio-io

  optional string sideEffects = 6;

  // TimeoutSeconds specifies the timeout for this webhook. After the timeout passes,
  // the webhook call will be ignored or the API call will fail based on the
  // failure policy.
  // The timeout value must be between 1 and 30 seconds.
  // Default to 10 seconds.
  // +optional
  optional int32 timeoutSeconds = 7;

  optional string sideEffects = 6;

  // TimeoutSeconds specifies the timeout for this webhook. After the timeout passes,
  // the webhook call will be ignored or the API call will fail based on the
  // failure policy.
  // The timeout value must be between 1 and 30 seconds.
  // Default to 30 seconds.
  // +optional
  optional int32 timeoutSeconds = 7;

  // description is an arbitrary string that usually provides guidelines on
  // when this priority class should be used.
  // +optional
  optional string description = 4;

  // preemptionPolicy is the Policy for preempting pods with lower priority.
  // One of Never, PreemptLowerPriority.
  // Defaults to PreemptLowerPriority if unset.
  // +optional
  optional string preemptionPolicy = 5;
}

However, we intentionally do not send those as part of the Workload API, in order to keep the size low.

The obvious solution to this is to put the list of selected workloads into the policy itself.
However, this means anytime a workload changes (often), we need to update the policy.

Instead, the opposite was chosen: each workload will list the policies that select it.

TAG ?= $(shell git rev-parse --verify HEAD)
ifeq ($(TAG),)
  $(error "TAG cannot be empty")
endif

PULL_POLICY ?= IfNotPresent
ifeq ($(TAG),latest)
  PULL_POLICY = Always
endif
ifeq ($(PULL_POLICY),)
  $(error "PULL_POLICY cannot be empty")
endif

PROW_ARTIFACTS_BASE ?= https://gcsweb.istio.io/gcs/istio-prow

include tools/proto/proto.mk

.PHONY: default