cniConfFileName: "istio-cni.conf"
  logLevel: info
  provider: "multus"
pilot:
  cni:
    enabled: true
    provider: "multus"
  variant: distroless
  env:
    PILOT_ENABLE_AMBIENT: "true"
    # Allow sidecars/ingress to send/receive HBONE. This is required for interop.
    PILOT_ENABLE_SENDING_HBONE: "true"
    PILOT_ENABLE_SIDECAR_LISTENING_HBONE: "true"
platform: openshift
variant: distroless
seLinuxOptions:

			"match at least one pod, and that there aren't multiple sidecar resources that select overlapping pods",
		Inputs: []config.GroupVersionKind{
			gvk.Sidecar,
			gvk.Pod,
			gvk.Namespace,
		},
	}
}

// Analyze implements Analyzer
func (a *SelectorAnalyzer) Analyze(c analysis.Context) {
	podsToSidecars := make(map[resource.FullName][]*resource.Instance)

kind: VirtualService
metadata:
  name: all
  namespace: testns
spec:
  hosts:
  - service3.default.svc.cluster.local
  - uk.bookinfo.com
  - eu.bookinfo.com
  gateways:
  - my-gateway
  - mesh # applies to all the sidecars in the mesh
  http:
  - match:
    - headers:
        cookie:
          regex: "^(.*?;)?(user=dev-123)(;.*)?"
    route:
    - destination:
        port:
          number: 81

    # should be one of the following two options:
    # * implies these objects are visible to all namespaces, enabling any sidecar to talk to any other sidecar.
    # . implies these objects are visible to only to sidecars in the same namespace, or if imported as a Sidecar.egress.host
    defaultConfigVisibilitySettings: []

    # Default node selector to be applied to all deployments so that all pods can be

  cniConfFileName: "istio-cni.conf"
  logLevel: info
  provider: "multus"
pilot:
  cni:
    enabled: true
    provider: "multus"
  variant: distroless
  env:
    PILOT_ENABLE_AMBIENT: "true"
    # Allow sidecars/ingress to send/receive HBONE. This is required for interop.
    PILOT_ENABLE_SENDING_HBONE: "true"
    PILOT_ENABLE_SIDECAR_LISTENING_HBONE: "true"
platform: openshift
variant: distroless
seLinuxOptions:

package kuberuntime

import (
	"time"

	v1 "k8s.io/api/core/v1"

	"k8s.io/kubernetes/pkg/kubelet/types"
)

// terminationOrdering is used to enforce a termination ordering for sidecar containers.  It sets up
// dependencies between sidecars and allows the pod termination process to wait until the grace period
// expires, or all dependent containers have finished terminating.
type terminationOrdering struct {

    # should be one of the following two options:
    # * implies these objects are visible to all namespaces, enabling any sidecar to talk to any other sidecar.
    # . implies these objects are visible to only to sidecars in the same namespace, or if imported as a Sidecar.egress.host
    defaultConfigVisibilitySettings: []

    # Default node selector to be applied to all deployments so that all pods can be

  cniConfFileName: "istio-cni.conf"
  logLevel: info
  provider: "multus"
pilot:
  cni:
    enabled: true
    provider: "multus"
  variant: distroless
  env:
    PILOT_ENABLE_AMBIENT: "true"
    # Allow sidecars/ingress to send/receive HBONE. This is required for interop.
    PILOT_ENABLE_SENDING_HBONE: "true"
    PILOT_ENABLE_SIDECAR_LISTENING_HBONE: "true"
platform: openshift
variant: distroless
seLinuxOptions:

1. Start the sleep service:

    If you have [automatic sidecar injection](https://istio.io/docs/setup/additional-setup/sidecar-injection/#automatic-sidecar-injection) enabled:

    ```bash
    kubectl apply -f sleep.yaml
    ```

    Otherwise manually inject the sidecars before applying:

    ```bash
    kubectl apply -f <(istioctl kube-inject -f sleep.yaml)
    ```

  cniConfFileName: "istio-cni.conf"
  logLevel: info
  provider: "multus"
pilot:
  cni:
    enabled: true
    provider: "multus"
  variant: distroless
  env:
    PILOT_ENABLE_AMBIENT: "true"
    # Allow sidecars/ingress to send/receive HBONE. This is required for interop.
    PILOT_ENABLE_SENDING_HBONE: "true"
    PILOT_ENABLE_SIDECAR_LISTENING_HBONE: "true"
platform: openshift
variant: distroless
seLinuxOptions: