# istio_injection.yaml
# Broken config in a yaml config file
#

# Namespace is explicitly enabled
apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio-injection: enabled
  name: default
---
# Namespace doesn't have the injection label, but is labeled for ambient
apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio.io/dataplane-mode: ambient
  name: ambient
---
# Namespace is explicitly disabled, Should not generate warning!
apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio-injection: disabled
  name: foo
---
# Namespace doesn't have the label at all
apiVersion: v1
kind: Namespace
metadata:
  name: bar
---
# Namespace is explicitly enabled in the new style
apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio.io/rev: canary
  name: canary-test
---
# Namespace is explicitly enabled in the new style, but refers to a non-existent control plane
apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio.io/rev: pidgeon
  name: pidgeon-test
---
# Namespace has both old and new labels
apiVersion: v1
kind: Namespace
metadata:
  name: busted
  labels:
    istio-injection: enabled
    istio.io/rev: canary
---
# Pod that's injected. No warning
apiVersion: v1
kind: Pod
metadata:
  name: injectedpod
  namespace: default
spec:
  containers:
  - image: gcr.io/google-samples/microservices-demo/adservice:v0.1.1
    name: server
  - image: registry.istio.io/release/proxyv2:1.3.0-rc.2
    name: istio-proxy
---
# Pod that's not injected and should be. Should generate warning
apiVersion: v1
kind: Pod
metadata:
  name: noninjectedpod
  namespace: default
spec:
  containers:
  - image: gcr.io/google-samples/microservices-demo/adservice:v0.1.1
    name: server
---
# Pod that explicitly disables injection. Should not generate a warning.
apiVersion: v1
kind: Pod
metadata:
  name: podinjectiondisabled
  namespace: default
  annotations:
    sidecar.istio.io/inject: "false"
spec:
  containers:
  - image: gcr.io/google-samples/microservices-demo/adservice:v0.1.1
    name: server
---
# Control plane pod proving the existence of istio.io/rev 'canary'
apiVersion: v1
kind: Pod
metadata:
  name: istiod-canary-1234567890-12345
  namespace: istio-system
  labels:
    app: istiod
    istio: pilot
    istio.io/rev: canary
spec:
  containers:
  - image: gcr.io/google-samples/microservices-demo/adservice:v0.1.1
    name: server
---
# Pod that explicitly disables injection with label. Should not generate a warning.
apiVersion: v1
kind: Pod
metadata:
  name: podinjectiondisabled-label
  namespace: default
  labels:
    sidecar.istio.io/inject: "false"
spec:
  containers:
    - image: gcr.io/google-samples/microservices-demo/adservice:v0.1.1
      name: server
---
# Pod that explicitly disables injection with label. Should not generate a warning.
apiVersion: v1
kind: Pod
metadata:
  name: podinjectiondisabled-label-and-anno
  namespace: default
  annotations:
    sidecar.istio.io/inject: "true"
  labels:
    sidecar.istio.io/inject: "false"
spec:
  containers:
    - image: gcr.io/google-samples/microservices-demo/adservice:v0.1.1
      name: server
# Pod on the host network that's not injected and should not be. Should not generate warning
---
apiVersion: v1
kind: Pod
metadata:
  name: noninjectedpodhostnetwork
  namespace: default
spec:
  hostNetwork: true
  containers:
  - image: gcr.io/google-samples/microservices-demo/adservice:v0.1.1
    name: server
---
apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio-injection: enabled
    istio.io/rev: test
  name: multi-ns-1
---
apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio-injection: enabled
    istio.io/dataplane-mode: ambient
  name: multi-ns-2
---
apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio.io/rev: test
    istio.io/dataplane-mode: ambient
  name: multi-ns-3
---
apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio-injection: disabled # should not generate warning since it's disabled
    istio.io/dataplane-mode: ambient
  name: not-conflict-ns-1
---
apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio-injection: disabled # should not generate warning since it's disabled
    istio.io/rev: test
  name: not-conflict-ns-2