metadata:
  labels:
    app: sidecar-injector
    install.operator.istio.io/owning-resource: example-istiocontrolplane
    install.operator.istio.io/owning-resource-namespace: istio-system
    istio.io/rev: default
    operator.istio.io/component: Pilot
    operator.istio.io/managed: Reconcile
    operator.istio.io/version: 1.14.0
    release: istio
  name: istio-sidecar-injector
webhooks:
  - admissionReviewVersions:

    # This enables injection of sidecar in all namespaces,
    # with the exception of namespaces with "istio-injection:disabled" annotation
    # Only one environment should have this enabled.
    enableNamespacesByDefault: false
    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run

apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
{{- if eq .Release.Namespace "istio-system"}}
  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
{{- else }}
  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
{{- end }}
  labels:

    # This enables injection of sidecar in all namespaces,
    # with the exception of namespaces with "istio-injection:disabled" annotation
    # Only one environment should have this enabled.
    enableNamespacesByDefault: false

    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run

			config.RepairConfig{
				SidecarAnnotation: "sidecar.istio.io/status",
				InitContainerName: constants.ValidationContainerName,
				InitExitCode:      126,
			},
			workingPod,
			false,
		},
		{
			"Testing working pod (that previously died) with only ExitCode check",
			config.RepairConfig{
				SidecarAnnotation: "sidecar.istio.io/status",
				InitContainerName: constants.ValidationContainerName,

metadata:
  labels:
    app: sidecar-injector
    istio.io/tag: default
  name: w-istio-sidecar-injector-istio-system
  
webhooks:
- admissionReviewVersions:
  - v1beta1
  - v1
  clientConfig:
    service:
      name: istiod
      namespace: istio-system
      path: /inject
      port: 443
  failurePolicy: Fail
  matchPolicy: Equivalent
  name: rev.namespace.sidecar-injector.istio.io
  namespaceSelector:

  "namespace" .Release.Namespace }}
{{- define "core" }}
{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
a unique prefix to each. */}}
- name: {{.Prefix}}sidecar-injector.istio.io
  clientConfig:
    {{- if .injectionURL }}
    url: "{{ .injectionURL }}"
    {{- else }}
    service:
      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}

{{- $whv := dict
 "revision" .Values.revision
  "injectionURL" .Values.istiodRemote.injectionURL
  "namespace" .Release.Namespace }}
{{- define "core" }}
- name: {{.Prefix}}sidecar-injector.istio.io
  clientConfig:
    {{- if .injectionURL }}
    url: {{ .injectionURL }}
    {{- else }}
    service:
      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}

ECDS NAME                                                     TYPE
istio.io/telemetry/stats/prometheus/sidecar/Inbound/HTTP      
istio.io/telemetry/stats/prometheus/sidecar/Inbound/TCP       
istio.io/telemetry/stats/prometheus/sidecar/Outbound/HTTP     
istio.io/telemetry/stats/prometheus/sidecar/Outbound/TCP      
default.display-metadata                                      envoy.extensions.filters.http.wasm.v3.Wasm

     */}}
    template: {{ `{{ Template_Version_And_Istio_Version_Mismatched_Check_Installation }}` | quote }}
    templates:
{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "sidecar") }}
      sidecar: |
{{ .Files.Get "files/injection-template.yaml" | trim | indent 8 }}
{{- end }}
{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "gateway") }}
      gateway: |