if err == nil {
			webhookURL.Path = "/validate"
			whConfig.URL = webhookURL.String()
		}
	}

	// ValidatingWebhookConfiguration failurePolicy is managed by Istiod, so if currently we already have a webhook in cluster
	// that is set to `Fail` by Istiod, we avoid of setting it back to the default `Ignore`.
	vwh, err := client.Kube().AdmissionregistrationV1().ValidatingWebhookConfigurations().

    subgraph cluster_istioagent {
        label = "Istio Agent"
        color="orange"
        sds
        xdsproxy
    }

    subgraph cluster_istiod {
        label = "Istiod"
        color="lightblue"
        ca
        discovery
    }

defaultConfig:
  discoveryAddress: istiod-rev-1.istio-system.svc:15012
  proxyMetadata:
    CANONICAL_REVISION: latest
    CANONICAL_SERVICE: foo
    CLUSTER_MESH_CONFIG_VALUE: foo
    ISTIO_META_CLUSTER_ID: Kubernetes
    ISTIO_META_DNS_CAPTURE: "true"
    ISTIO_META_MESH_ID: ""
    ISTIO_META_NETWORK: ""
    ISTIO_META_WORKLOAD_NAME: foo
    ISTIO_METAJSON_LABELS: '{"service.istio.io/canonical-name":"foo","service.istio.io/canonical-revision":"latest"}'

defaultConfig:
  discoveryAddress: istiod-rev-1.istio-system.svc:15012
  proxyMetadata:
    CANONICAL_REVISION: latest
    CANONICAL_SERVICE: foo
    CLUSTER_MESH_CONFIG_VALUE: foo
    ISTIO_META_CLUSTER_ID: Kubernetes
    ISTIO_META_DNS_CAPTURE: "true"
    ISTIO_META_MESH_ID: ""
    ISTIO_META_NETWORK: ""
    ISTIO_META_WORKLOAD_NAME: foo
    ISTIO_METAJSON_LABELS: '{"service.istio.io/canonical-name":"foo","service.istio.io/canonical-revision":"latest"}'

CANONICAL_REVISION='latest'
CANONICAL_SERVICE='foo'
CA_ADDR='istiod-rev-1.istio-system.svc:15012'
CLUSTER_MESH_CONFIG_VALUE='foo'
ISTIO_INBOUND_PORTS='*'
ISTIO_LOCAL_EXCLUDE_PORTS='22,15090,15021,15020'
ISTIO_METAJSON_LABELS='{"service.istio.io/canonical-name":"foo","service.istio.io/canonical-revision":"latest"}'
ISTIO_META_CLUSTER_ID='Kubernetes'
ISTIO_META_DNS_CAPTURE='true'
ISTIO_META_MESH_ID=''
ISTIO_META_NETWORK=''
ISTIO_META_WORKLOAD_NAME='foo'

CANONICAL_REVISION='latest'
CANONICAL_SERVICE='foo'
CA_ADDR='istiod-rev-1.istio-system.svc:15012'
CLUSTER_MESH_CONFIG_VALUE='foo'
ISTIO_INBOUND_PORTS='*'
ISTIO_LOCAL_EXCLUDE_PORTS='22,15090,15021,15020'
ISTIO_METAJSON_LABELS='{"service.istio.io/canonical-name":"foo","service.istio.io/canonical-revision":"latest"}'
ISTIO_META_CLUSTER_ID='Kubernetes'
ISTIO_META_DNS_CAPTURE='true'
ISTIO_META_MESH_ID=''
ISTIO_META_NETWORK=''
ISTIO_META_WORKLOAD_NAME='foo'

/Makefile.core.mk                                                @istio/wg-test-and-release-maintainers
/bin/                                                            @istio/wg-test-and-release-maintainers
/cmd/istiod/                                                     @istio/wg-environments-maintainers
/cni/                                                            @istio/wg-networking-maintainers

			IstiodHost(istioNamespace, revision), istioNamespace)
	}
	return os.WriteFile(filepath.Join(dir, "hosts"), []byte(hosts), filePerms)
}

func isRevisioned(revision string) bool {
	return revision != "" && revision != "default"
}

func IstiodHost(ns string, revision string) string {
	istiod := "istiod"
	if isRevisioned(revision) {

particular, ztunnel only supports 2 (custom) xDS resources: [`Workload`](../../pkg/workloadapi/workload.proto) and [`Authorization`](../../pkg/workloadapi/security/authorization.proto). As such, ztunnel does not receive `PeerAuthentication`s directly; when istiod detects a `PeerAuthentication` resource that targets an Ambient captured workload, it computes the effective policy for that workload (taking into account the mesh-wide -> namespace -> workload precedence rules) and sends that policy to ztunnel. The...

   functions.

  > Note: The service mesh is not an overlay network. It
  > simplifies and enhances how microservices in an application talk to each
  > other over the network provided by the underlying platform.

- **Istiod** - The Istio control plane. It provides service discovery, configuration and certificate management. It consists of the following sub-components:

    - **Pilot** - Responsible for configuring the proxies at runtime.