apiVersion: v1
name: base
# This version is never actually shipped. istio/release-builder will replace it at build-time
# with the appropriate version
version: 1.0.0
appVersion: 1.0.0
tillerVersion: ">=2.7.2"
description: Helm chart for deploying Istio cluster resources and CRDs
keywords:
  - istio
sources:
  - https://github.com/istio/istio
engine: gotpl

apiVersion: v1
name: istio-ingress
# This version is never actually shipped. istio/release-builder will replace it at build-time
# with the appropriate version
version: 1.0.0
appVersion: 1.0.0
tillerVersion: ">=2.7.2"
description: Helm chart for deploying Istio gateways
keywords:
  - istio
  - ingressgateway
  - gateways
sources:
  - http://github.com/istio/istio
engine: gotpl

  imagePullSecrets: []

  # Specify image pull policy if default behavior isn't desired.
  # Default behavior: latest images will be Always else IfNotPresent.
  imagePullPolicy: ""

  # Used to replace istioNamespace to support operator watch multiple namespaces.
  watchedNamespaces: istio-system
  waitForResourcesTimeout: 300s

  # Used for helm2 to add the CRDs to templates.
  enableCRDTemplates: false

	// lock current snapshot pod map
	p.mu.Lock()
	defer p.mu.Unlock()
	if existing := p.currentPodCache[uid]; existing.Netns != nil {
		if existing.Netns.Inode() == workload.Netns.Inode() {
			workload.Netns.Close()
			// Replace the workload, but keep the old Netns
			p.currentPodCache[uid] = WorkloadInfo{
				Workload: workload.Workload,
				Netns:    existing.Netns,
			}
			// already in cache
			return existing.Netns
		}

apiVersion: v1
name: istiod-remote
# This version is never actually shipped. istio/release-builder will replace it at build-time
# with the appropriate version
version: 1.0.0
appVersion: 1.0.0
tillerVersion: ">=2.7.2"
description: Helm chart for a remote cluster using an external istio control plane
keywords:
  - istio
  - external-istiod
sources:
  - https://github.com/istio/istio
engine: gotpl

  // Valid values are:
  //
  // - "Allow" (default): allows CronJobs to run concurrently;
  // - "Forbid": forbids concurrent runs, skipping next run if previous run hasn't finished yet;
  // - "Replace": cancels currently running job and replaces it with a new one
  // +optional
  optional string concurrencyPolicy = 3;

  // This flag tells the controller to suspend subsequent executions, it does

  optional StatefulSetPersistentVolumeClaimRetentionPolicy persistentVolumeClaimRetentionPolicy = 10;

  // ordinals controls the numbering of replica indices in a StatefulSet. The
  // default ordinals behavior assigns a "0" index to the first replica and
  // increments the index by one for each additional replica requested. Using
  // the ordinals field requires the StatefulSetStartOrdinal feature gate to be
  // enabled, which is beta.
  // +optional

  // Label query over pods whose evictions are managed by the disruption
  // budget.
  // A null selector will match no pods, while an empty ({}) selector will select
  // all pods within the namespace.
  // +patchStrategy=replace
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 2;

  // An eviction is allowed if at most "maxUnavailable" pods selected by

}

func (m *IPSet) AddIP(ip netip.Addr, ipProto uint8, comment string, replace bool) error {
	ipToInsert := ip.Unmap()

	// We have already Unmap'd, so we can do a simple IsV6 y/n check now
	if ipToInsert.Is6() {
		return m.Deps.addIP(m.V6Name, ipToInsert, ipProto, comment, replace)
	}
	return m.Deps.addIP(m.V4Name, ipToInsert, ipProto, comment, replace)
}

func (m *IPSet) DeleteIP(ip netip.Addr, ipProto uint8) error {

	// For each pod IP
	for _, pip := range podIPs {
		// Add to host ipset
		log.Debugf("adding pod %s probe to ipset %s with ip %s", pod.Name, hostsideProbeSet.Prefix, pip)
		// Add IP/port combo to set. Note that we set Replace to true - a pod ip/port combo already being
		// in the set is perfectly fine, and something we can always safely overwrite, so we will.
		if err := hostsideProbeSet.AddIP(pip, ipProto, podUID, true); err != nil {